Airony Company Inc. (the “Company”, “we”) provides the BLOCROWN service and complies with the Korean Personal Information Protection Act (PIPA). This policy is based on the items our server actually stores. The Service does not collect your device's contacts, your whole photo library or your phone number, and it does not send your device's real location (GPS) to our server or store it. Items marked “(where offered)” are processed only after that feature has been opened in the Service.
| Category | Items | Purpose | Legal basis |
|---|---|---|---|
| Sign-up (required) | Email, display name (nickname · picked automatically when you sign up with an email code, and you can change it), country (pre-filled from your device’s language and time zone settings and confirmed by you), language, confirmation of eligible sign-up age, the versions of the Terms and Policy you agreed to and when (including when you agreed again) | Identifying members, login, notices, confirming consent to changes in the Terms | Performance of contract (PIPA Art. 15(1)(4)) |
| Brand account (where offered) | Business email, brand name, official domain, confirmation that you are 19 or older and authorized to represent the brand, and when, the DNS value for domain verification, the administrator's review result | Verifying the brand and its official domain, preparing a virtual brand storefront | Performance of contract |
| Password (optional) | Password — only if you create one, stored only as an irreversible hash (required if you sign up with a password until 2026-10-08) | Signing in with a password instead of an email code | Performance of contract |
| Email verification · sign-in codes · creating and recovering a password · confirming account deletion | Email, verification code (kept as a hash for 10 minutes, then deleted), sign-up check value (only for a new email whose code was entered correctly · kept as a hash for 30 minutes · deleted as soon as sign-up is complete), sign-up device check value (kept as a hash for 24 hours · deleted as soon as verification is complete) | Verifying your identity | Performance of contract |
| Sign-in alerts (from 2026-10-09) | Email, sign-in time, device type (app or web browser and operating system name — read from the connection at that moment only, not stored) | Telling you about new sign-ins so you can quickly notice misuse of your account (up to 5 a day · no IP address or location · a security alert you cannot turn off, separate from marketing email consent) | Performance of contract · legitimate interest (account protection) |
| Phone verification (where required) | Mobile phone number — only a pseudonymized value (HMAC) is stored on the server. The key used for the calculation is kept separately from the database. The number itself is used only to send the verification text and is not kept. | One account per number (preventing duplicate accounts) | Performance of contract · fraud prevention |
| Find email (where offered) | The nickname (ID) you enter — not stored; a hashed value of the requesting network's IP address and the number of requests that day | Showing a member who forgot their sign-up email a partly hidden version of it (only the first two and last one characters, and the first two characters of the domain), preventing abuse | Performance of contract · legitimate interest (preventing abuse of the service) |
| Staying logged in | Session token (hash), expiry time, whether “Keep me logged in” was chosen, time of last use (extension), time of first login | Keeping you logged in (an essential cookie on the web; a token stored on the device in the apps). With “Keep me logged in” on, you do not need to log in again for 90 days from your last use (up to 1 year after first login); with it off, the session ends when you close the browser or app (after 1 day on the server). | Performance of contract |
| Friend referrals (where offered) | Referral link number and when it was created and expires (referring member); the link between a member who signed up with that link and the referring member, when it was made and its result; the dates (dates only, no times) on which the new member used the service | Deciding referral rewards (new account · not a self-referral · 48 hours after sign-up · 2 different days of use), the monthly reward limit, preventing fraudulent referrals | Performance of contract · legitimate interest (preventing misuse) |
| Game records (members) | Titles, emblems, name colors and purchased outfits, level and experience, ranking records, earlier climb records and badges (no longer added to), block list, reports you filed (type, reason, outcome) | Providing the game, rankings, handling reports | Performance of contract |
| Space operation (members) | Operating records: building, how it was acquired (arriving at the entrance · first hideout chosen on the map), the entrance spot confirmed by the server (in-game coordinates), the owner's last visit time, the owner's last update time, end of the operating period and end of the grace period, status, release and reopening times, reasons for a return or an operational action Also: records confirming owner visits (how long the space was kept open), records of choosing and moving the first hideout, records of scheduled and sent operating notices, Points ledger (changes, reason, time), takeover listing applications (order number, result), upkeep bills and payment records under the previous policy (kept only), stage progress | Calculating the operating period (visits and updates), deadline and grace period notices, release and reopening, the first hideout's 1 year, fair order for takeover listings | Performance of contract · fraud prevention |
| Decoration archive (members) | One set of decorations kept when a first hideout ends: building, end time and reason, a copy of the facade decoration settings, the IDs of content that was public at the time, a copy of the space settings (category, subtopic, tags, visibility, guestbook open or closed, featured content), the result of bringing them over (space applied to, time, summary) and request ID | Bringing decorations over to a new first hideout | Performance of contract |
| Rooftop decorating (members) | Rooftop prop layout (type, position, direction, color), personal sign text (up to 12 characters), prop storage records, blueprints, archived layouts from past operating periods | Saving and loading decorations, returning props and providing blueprints after operation ends | Performance of contract |
| Visits · one-line guestbook · stickers (members) | Your space visibility setting (Public / Block Meeting only / Only me · accept new entries), one-line guestbook entries you left (text up to 80 characters, created and edited times, edit count, estimated language of the text, and for a follow-up greeting, which entry it follows) and stickers, the space owner's replies, reports you filed (reason, note, a copy at the time of the report), entries you hid, visit records (space visited, date, path · once a day), request IDs | Providing visits and the guestbook, one more greeting on an entry the owner replied to (follow-up · within 7 days of the reply · once per entry · where offered), preventing spam and the exchange of contact details, reports, blocking and operational actions, visit metrics (no rewards) | Performance of contract · legitimate interests (preventing abuse) |
| Post comments · likes (members · where offered) | Comments you write (text up to 300 characters, created and edited times, edit count, estimated language, which post the comment is on), the post owner's replies, posts you liked and when you liked them, comment reports you filed (reason, note, a copy of the text at the time of the report) | Showing, editing and deleting comments, collecting the posts you liked (visible only to you), in-app notifications to the post owner (comments, replies, likes — like notifications do not say who liked or how many), handling reports and preventing spam | Performance of contract · legitimate interests (running a safe community) |
| Open plazas (members · where offered) | Plaza posts you left (which plaza, text up to 200 characters, up to 1 photo (the photo ID from your photo library), time posted, estimated language, whether replies are turned off), plaza replies you wrote (text up to 80 characters, time, estimated language), replies you hid on your posts, posts you tapped a heart on and when, posts and replies you hid for yourself, plaza reports you filed (reason, a copy of the text at the time of the report, a hashed value of the IP address of the network you reported from), a fingerprint (hash) of the text to prevent the same post being repeated, request IDs · when non-members read plazas we collect no new personal information, and only count IP addresses briefly in server memory to prevent excessive requests (not stored) | Showing and deleting plaza posts and replies, showing the posts you hearted (only to you), in-app notifications about replies to your posts, checking limits and preventing spam, repeated posts and the exchange of contact details, handling reports (checking that reports come from different people) and operational actions, “This week's plaza” notices | Performance of contract · legitimate interests (running a safe community · preventing abuse) |
| Featured content (members) | Your space's category, subtopic and tags, content (title, text, photos, video IDs, etc.) and its estimated language, photos (re-created in the app as JPEGs of up to 1600px with location and device information (EXIF) removed, and stripped once more by the server · whether you confirmed your rights), draft/public/archived status and times, archive, saved spaces, reports you filed | Creating and publishing content and showing it to visitors, automatic checks of photos for explicit content (on our server · nothing sent outside), the discovery list, reports and operational actions | Performance of contract · legitimate interests (preventing abuse) |
| Account photo library · photo albums (members · where offered) | Photos you upload (resized in the app to a long side of up to 2048px or 3072px depending on the quality you choose, then re-created by the server as three JPEGs — large, screen size (1024px) and small (384px) — with location and device information (EXIF) removed), each photo's dimensions, size, quality choice, upload time and rights confirmation, an input fingerprint used to avoid storing the same photo twice (compared only within your own account), upload batch and job status and request IDs, upload attempt records (for rate limits), trash status and time, where the photo is used, and album titles, text, tags, photo captions, order and cover | Keeping photos and reusing them in several posts, creating and publishing multi-photo albums, album search, managing account storage (200 photos · 200MB), avoiding duplicate copies, automatic explicit-image checks (on our servers · nothing sent outside), preventing excessive uploads | Performance of contract · legitimate interests (preventing abuse) |
| Block Meeting (members) | Circle name and tag, members and roles (chair), visibility settings, join requests (request time · expire after 7 days), announcements (text, author, time), Block Meeting summons (venue building, entrance spot, start and end, each member's attendance and response time, in-game position just before the summon (city, in-game coordinates), time moved, result of and reason for the return) | Running the Circle, delivering announcements, moving members to the summoned building and returning them to their original spot after 24 hours | Performance of contract |
| Regulars · profile (where offered) | Public profile (public ID, intro up to 80 characters, 3 interests, featured space, public or not · public by default for members who sign up from 2026-10-05, and you can switch it to private at any time in settings · members who signed up earlier keep their existing setting), regulars relationships (who registered whose space, status), channel subscriptions (subscribed buildings and time · visible only to you), likes, bookmarks, update notification settings, read markers · when non-members read the World Rooftop feed we collect no new personal information, and only count IP addresses in server memory for 10 minutes to prevent excessive requests (not stored) | Delivering updates from regular spots and subscribed channels, viewing profiles, World Rooftop feed | Performance of contract |
| Chat (where offered) | Chat requests (sending and receiving accounts, time, status), chat messages (text, time, read, estimated language), chat settings (accept requests, show read status), chat reports (a copy of the reported message and the messages around it). No real location is stored in chats. | One-to-one chat between members, preventing harassment and spam, handling reports | Performance of contract · legitimate interests |
| External account connection (where offered) | The connected service (YouTube, Instagram, Threads, etc.) and your account ID there, access token (AES-256-GCM encrypted), the address of the connected original post and permitted information (title, thumbnail, etc.) | Showing your original posts from other social networks in your space | Consent (when connecting) |
| Start near me (where offered) | The device's current location (latitude, longitude, accuracy) — processed once on the device only, and not sent to or stored on the server. The server stores only the starting area ID, how you started and the virtual in-game starting point. | Choosing the nearest supported area and an in-game starting point, continuing on another device | Consent (when you tap the button · device permission) |
| Auto travel (in-game trips) | In-game city IDs of departure and arrival, the mode, in-game times, fare and refund of each leg, and the in-game position where a trip stopped (city ID · in-game coordinates) — not your real location (GPS) In-game coordinates of the arrival point you picked with the pin · the route shape drawn on the map (in-game coordinates · not your real location (GPS)) | Settling travel fares and finalizing your character's position | Legitimate interests |
| In-app notifications | Notification type, related space or plaza, read status, time, notification settings by category (including how often you get plaza notices) | Operating deadline and grace period notices, guestbook, Block Meeting and chat updates, and post comment, reply and like updates (where offered · comment notifications do not include who wrote the comment, and like notifications are grouped into one line a day without saying who liked or how many), plaza reply updates and “This week's plaza” notices (where offered · notices go once a week by default to members who have logged in within the last 7 days · you can reduce them to once every 2 weeks or turn them off in settings). Notifications are delivered through the in-app notification inbox and notices shown when you log in. Operating deadline and grace period notices are not sent by email or device notification (push). Plaza notifications are not sent by email or device notification (push) either. Replies and comments, regulars' updates, chat and the like summary are also sent as device notifications only if you allow device notifications in the app (see “Device notifications” below). However, “new sign-in” alerts that protect your account are sent by email (from 2026-10-09). | Performance of contract |
| Device notifications (push · apps · where offered · only if you allow them) | Device notification token (a value Google Firebase issues for each device), device type (iOS, Android), registration and last-checked times, a check value for the login session that registered it (hash), notification settings by category (replies and comments · regulars' updates · chat · like summary), records of notifications sent (type, decision, time — no message text) | Notifying your device of replies, one-line entries and comments on your posts and guestbook, regulars' updates, chat requests and messages, and a once-a-day like summary. Notification text never includes other members' names, profiles, posts or chat content, and like notifications do not say who liked or how many. Between 10 p.m. and 8 a.m. only chat notifications are sent. Operating deadline and grace period notices are not sent as device notifications. | Consent (allowing the device permission) · can be withdrawn at any time |
| Server translation (optional · only when tapped · where we have set up a translation service) | The text of the one entry you tapped “Translate” on and the target language (the author's name and account information are not sent), the translation result (cached for the same entry and language) | Reading entries written in another language | Performance of contract (only on request) |
| On-device translation (apps · where offered) | We do not receive the text being translated or the translation (only entries you tap “Translate with Google” on are translated, on the user's device; translation models are downloaded to the device once per language, and settings, models and translations are stored only on the device — section 7). However, if you were viewing a translation of an entry when you report it, that translation (up to 1,200 characters) is stored with the report copy. | For reference when handling reports (decisions are based on the original text) | Legitimate interests (running a safe community) |
| Paid purchases (where offered) | Store transaction ID, product, amount, purchase time, payment environment (production/test), status (delivered/refunded), Points ledger (free, bonus and paid portions and their validity), former Credit ledger, passes | Delivering Points, handling withdrawals, refunds and disputes | Performance of contract, record-keeping obligation under the E-Commerce Act |
| Facade ad orders (Republic of Korea members) | Advertiser: order details (building, wall, period), payment amount and VAT, payment method, deposit confirmation code, time you confirmed you are 19 or older and authorized to pay, ad photo, video, text and notes, order status and times, operations notes. For refunds, the refund bank account received by email. Wall operator: ad share settlement records | Taking ad orders, confirming deposits, reviewing, posting and settling; withdrawals and refunds; handling disputes | Performance of contract, record-keeping obligation under the E-Commerce Act |
| Online presence display | Display name, in-game (virtual) position and direction, character look — kept only in server memory, not stored | Showing your character to players nearby | Performance of contract |
| Operational logs | Member ID, activity type (sign-up, verification, purchase, agreeing again to the Terms, etc.), time, administrator action logs | Security, fraud prevention, handling inquiries | Legitimate interests, legal obligation to ensure security |
| Brand storefront entries and returns (where offered) | Storefront ID, entry and return times, how it was opened, visitor (member ID · for non-members, a value pseudonymized with a secret key created fresh each day) | Counting each visit once, giving brands entry and return counts (numbers only) | Performance of contract, legitimate interests |
| Facade ad views | Ad ID, date and time, member ID (for non-members, a value that pseudonymizes the IP address and device information with a secret key created fresh each day), reward status | Deciding the once-a-day reward, providing click counts (totals only) | Performance of contract, legitimate interests |
| Usage statistics (can be turned off in Settings) | A random install ID and session ID created on the device, app version, platform, in-game city and building ID, referral tag, game step records and time taken, and, when logged in, member ID and sign-up country. GPS, real location, photos, text and IP addresses are not stored. | Improving the first experience and return visits, finding errors (not used for ad tracking) | Legitimate interests (you can refuse in Settings) |
| Marketing (optional) | Whether you agreed to receive news | Telling you about news | Consent (PIPA Art. 15(1)(1)) |
Guest play records, Guest Points, the wardrobe and facade decoration photos kept on the device are not sent to the server and are stored only on the device. We briefly use IP addresses in server memory for rate limiting but do not store them; the hosting provider's access logs may briefly keep IP addresses and access times. A brand homepage opened with “Enter” in the game is a separate site run by that brand and follows that site's own policy.
| Item | Period |
|---|---|
| Account information | Until you delete your account → deleted immediately on deletion (member IDs in operational logs are replaced with irreversible values) |
| Friend referral records | Until you delete your account → deleted immediately on deletion. A referral link can no longer be used 7 days after it is created. |
| Sign-up requests whose email verification was not completed | 7 days from the request → deleted |
| Verification codes | Deleted immediately once used · if unused, deleted within 10 minutes after they expire (10 minutes) |
| Phone verification pseudonymized value (HMAC) | Until you delete your account → deleted 30 days after deletion (to prevent signing up again with the same number to multiply accounts) |
| Space operating records, Points ledger, acquisition applications, stage progress | Until you delete your account → on deletion, Points and stage progress are deleted immediately and pending acquisition applications are cancelled. Spaces you were running go to an takeover listing, and operating records and old bills are kept in a form that no longer identifies the member. |
| Decoration archive | Until you delete it or your account → deleted immediately on account deletion |
| Rooftop decoration layouts, sign text, storage, blueprints | While you have an account → deleted immediately on account deletion. Layouts from ended operation remain as read-only archives, and an automatic blueprint is kept for each operating period (deleted when you delete it or your account). |
| Featured content, photos, saves | Drafts, published content and the archive: until you delete them or your account · deleted content: text and photos deleted immediately, the record row deleted after 30 days · photos not used anywhere: deleted after 1 day · text of content made private under our policies and copies made at the time of a report: 90 days · handled report records (without copies): 3 years. Deleted immediately when you delete your account |
| Account photo library · photo albums (where offered) | Until you delete them or your account · deleted photos stay in the trash for 72 hours and then all three sizes are deleted (if a post or slot still uses the photo, you need to remove it there first) · temporary files from unfinished uploads are deleted when the job ends or after 1 hour · upload attempt records 2 days · upload job records until account deletion · deleting an album (post) deletes its title, text, tags and captions while the photos stay in your library. Deleted immediately on account deletion |
| One-line guestbook, stickers, visits | Entries deleted by the author: text deleted immediately, the record row deleted after 30 days · text of entries hidden under our policies and copies made at the time of a report: 90 days · guestbooks of spaces whose operation ended (the read-only archive kept for the previous owner): not deleted based on time · visit records: 180 days · translation cache: 30 days · follow-up greetings follow the same periods. When you delete your account, the text of your entries is deleted immediately and replaced with “Former explorer”, and the entries are deleted after 30 days |
| Post comments · likes (where offered) | Comments deleted by the author: text deleted immediately, the record row deleted after 30 days · when a post is deleted, the text of its comments and its likes are deleted with it · when a post is made private (archived) or the space's operation ends, its comments are no longer shown · copies of reported text under review by our operators are kept until the report is handled. When you delete your account, the text of your comments is deleted and the author is shown as anonymous, and your likes are deleted |
| Open plazas (where offered) | Until you delete them or your account · posts and replies deleted by the author: text deleted immediately (photos follow the photo library rules), the record row deleted after 30 days · text of posts hidden under our policies and copies made at the time of a report: 90 days · hearts and hide-for-me records: deleted when you undo them or the post is deleted · request IDs: 7 days. When you delete your account, the text of your plaza posts and replies is deleted immediately and the record rows after 30 days, and your hearts and hide-for-me records are deleted immediately |
| Block Meeting | Membership, settings and announcements: while the Circle exists · join requests expire after 7 days · summon records (attendance, position just before the summon, result of the return) are kept as Circle operating records. When you delete your account, your join requests and summon attendance records are deleted immediately; announcements written by the chair remain in the Circle. |
| Regulars · profile (where offered) | Until you delete them or your account → deleted immediately on account deletion |
| Chat (where offered) | 30 days after the last message → deleted · chat report copies: 180 days · when an account is deleted, chats involving that member (both people's messages) are deleted immediately, and report copies are only unlinked from the account |
| External account connection (where offered) | Until you disconnect or delete your account → when you disconnect, access is revoked and the token is deleted immediately · original post information is cleared and re-checked every 30 days |
| Start near me (where offered) | Real location: not stored (discarded immediately after processing on the device) · starting area and virtual starting point: until you delete your account or reset it in Settings |
| Auto travel (in-game trips) | Kept for 7 days after the trip ends |
| In-app notifications | 90 days → deleted · deleted immediately on account deletion |
| Device notification tokens | Logging out deletes that device's token immediately · “Log out of all devices” or account deletion deletes the tokens of all devices immediately · devices whose session ended through a password reset or login expiry stop receiving notifications from then, and their tokens are deleted within 1 hour · tokens of devices that have not opened the app for 270 days, and tokens the notification server reports as invalid, are deleted (invalid tokens within 30 days) |
| Device notification settings | Until you delete your account → deleted immediately on account deletion |
| Records of notifications sent | 30 days → deleted · deleted immediately on account deletion |
| Payment, Point (including former Credit) and pass records, facade ad order and settlement records | Kept while the account exists · after account deletion, kept for 5 years from the deletion date (E-Commerce Act, Article 6), then deleted |
| Facade ad photos, videos, text and notes | 90 days from the day posting ends or the order is cancelled, rejected or refunded → deleted |
| Refund bank account | Deleted without delay once the refund is complete |
| Translations stored with a report (on-device translation) | Same period as that report copy (e.g. guestbook and plazas: 90 days · chat: 180 days) |
| Records of consumer complaints, disputes and report handling | 3 years from receipt → deleted |
| Operational logs (member activity type and time) | 3 months → deleted · administrator action logs: 2 years → deleted |
| Facade ad view records | 90 days → deleted · a member's records are deleted immediately on account deletion |
| Usage statistics | 180 days from receipt → deleted (after that, only daily totals) · on account deletion, the link to the member ID is removed immediately |
| Login sessions | “Keep me logged in”: 90 days from your last use (up to 1 year after first login) · not kept: 1 day · deleted immediately when you log out; resetting your password or tapping “Log out of all devices” immediately deletes the sessions on all devices |
| Security counters such as failed login and find-email counts (IP addresses only as hashed values) | Deleted the next day (overwritten) |
When a period ends, the server deletes the data automatically every hour in a way that cannot be recovered (verification codes every 10 minutes). The hosting provider's access logs are kept briefly under that provider's policy.
We do not sell or provide personal information to third parties, except when there is a request under the law. The following information is visible to other users because of game features. Your email, phone number, payment history, internal member ID and real location are not visible (your email only in the hidden form shown by “Find email” below).
| Where | Who can see it | What is shown |
|---|---|---|
| Rankings | Anyone | Display name, sign-up country, level and title, emblem and name color, number of spaces you run and other values shown on the ranking screen (the Block Meeting name tag only if the chair turned it on) |
| Building owner labels | Anyone | Display name of the member running the building and when they started operating it (the name is hidden while use is restricted) · for released buildings, only “Reopening soon” (the grace period and last visit are not shown) |
| Space visits, guestbook, featured content | The visibility the owner chose (Public · Block Meeting only · Only me) | Building name, the owner's display name, guestbook entries (author's display name, time, text), the public rooftop layout and sign text, published content. Visitor counts are shown only to the owner, as totals. |
| Post comments · likes (where offered) | People who can see that post (the space's visibility: Public · Block Meeting only · Only me) | The comment author's display name, text and time. Members who have blocked each other cannot see each other's comments, and if you and the post owner have blocked each other you can neither see the post nor comment on it. Likes have no public count — only the person who liked a post sees it in their own “Liked posts”, and the post owner sees only the total likes on their own posts (not who liked them). |
| Open plazas (where offered) | Anyone (including non-members and web share links) | Which plaza (country or region) the post is in, the display name, avatar and operator badge of the author of each post and reply, the text, photo and time posted, the number of replies, and whether a post has replies turned off. Hearts have no public count for anyone, including the author, and who tapped them is not shown. Members who have blocked each other cannot see each other's plaza posts. Plaza posts do not appear on the author's profile, in the discovery feed or in search. |
| Block Meeting | Members of that Circle (the member list within the range set by the chair) | Circle name and tag, members' display names, announcements, summon venue, time and attendance |
| Photo albums · album search (where offered) | The visibility of the space the album is in (Public · Block Meeting only · Only me) | Album photos (small, screen and large sizes), title, text, tags, photo captions and number of photos. Search results, photo counts and tag groups only include albums visible to the viewer. Photos that are only in your library and not used in a post are not shown to anyone else. |
| Regulars · profile (where offered) | Anyone, if the profile is public (new members are public by default · only you once you switch it to private) | Public ID, intro, interests, featured space, number of regulars, and the collection of albums that member has published and you are allowed to see (photo gallery) |
| Chat (where offered) | The two people in the chat | Display names, chat messages, read status (if both people turned it on) |
| Online presence | Members logged in to the same city | Display name, title and emblem, character look, in-game position, direction and action (not real location) |
| Takeover listings | Anyone | Building, height, area, required stage, acquisition fee, closing time, number of applicants (the names of applicants and of the previous operator are not shown) |
| Live facade ads | Anyone | Ad photo and video, building and wall, end time of posting (the advertiser's name and the price are not shown) |
| Find email (where offered) | Anyone who enters a nickname (ID) · up to 5 times per 10 minutes and 20 times a day per network | The hidden email of the account that signed up with that nickname and completed email verification (only the first two and last one characters and the first two characters of the domain · e.g. sh****p@gm***.com). Because nicknames (IDs) are visible to other members, anyone can see this form. The full email is never shown. |
| Friend referrals | The referring member only | Only the number of referrals confirmed this month and the number being checked (the friend's name, email and usage are not shown) |
| Recipient (country) | Task | Items | When and how | Retention |
|---|---|---|---|---|
| Fly.io, Inc. (headquarters USA · servers in Tokyo, Japan) | Servers and data storage (cloud) | All server-stored items in section 1 (including photos in your account photo library in all three sizes · kept in the storage of our servers) | Sent over HTTPS during use | The retention periods above |
| Resend, Inc. (USA) | Sending verification code emails and account-protection “new sign-in” alerts (no marketing emails) | Email address, email content (verification code · sign-in time and device type) | Sent over HTTPS when you request a code or sign in | Resend's policy after sending |
| Twilio Inc. (USA) — where phone verification is required | Sending verification texts | Mobile phone number, verification code | Sent over HTTPS when you request verification | Twilio's policy after sending |
| DeepL SE (Germany) or Google LLC (USA) — where the operator has configured it | Translating text | The text of the one entry you tapped “Translate” on, the target language | Sent over HTTPS only when you tap | Each company's policy after translation |
| Apple Inc. · Google LLC (USA) — where paid purchases are offered | Processing in-app payments and checking receipts | Transaction ID, product (we do not receive card details) | At payment and verification | Each company's policy |
| Google LLC · Meta Platforms, Inc. (USA) — where external account connection is offered | Checking the YouTube, Instagram and Threads original posts you connected | Access token, original post address | HTTPS when you connect or when the original post is checked | Each company's policy |
| Google LLC (USA) — Firebase Cloud Messaging · where device notifications are offered | Delivering device notifications (on iOS, delivered via Apple Inc. (USA)'s Apple Push Notification service) | Device notification token, notification text (fixed sentences · no other member's information or post content), the in-app address to open when tapped (space, post or chat number) | Sent over HTTPS when a notification is sent | Google's and Apple's policies after delivery |
Photo checks for explicit content are done on our own server, and photos are not sent outside. Maps are served directly from our server using OpenStreetMap data. If you do not want your data transferred abroad, you can choose not to sign up, or delete your account (you can still play as a Guest, on your device only).
Your in-game character's position is not your real location. Where “Start near me” is offered, location permission is requested only when you tap that button, and the device's location is read only once. Location is not collected in the background. The coordinates are used on the device only to choose the nearest supported area and a virtual starting point and are then discarded immediately; they are not put into the server, analytics, share cards, guestbooks or profiles. However, your approximate area may be inferred from the request that downloads the local map. You can change location permission in your device settings at any time, and you can use every feature even if you decline.
On the web we use only one essential cookie (HttpOnly) to keep you logged in, and no advertising or analytics tracking cookies. With “Keep me logged in” on, this cookie lasts up to 90 days (extended each time you use the service); with it off, it is deleted when you close the browser. The iOS and Android apps do not include any third-party advertising SDK; they do not read or send the advertising identifier and do not request iOS App Tracking Transparency (ATT) permission. The app sends device notifications only if you allow them, and for this we store a device notification token on our server (section 1, “Device notifications”). On the device we store only the last registered token and whether you have seen the notification prompt. Game progress and settings such as “Remind me later about Terms changes” are saved in device storage and can be cleared in your browser or app settings. With “Remember email” on, the email you last logged in with is saved on this device and filled in at your next login; turning it off deletes it. Your password is never saved on the device. If you use on-device translation in the app (where offered), your translation settings (stored on this device and not sent to our server), downloaded translation models (about 30 MB per language) and translations (up to 30 days · deleted when you log out or switch accounts) are stored only on this device. You can delete downloaded models in Settings › Language & translation.
Children under 14 cannot sign up. If we learn of such an account, we immediately delete the account and its information. If a country's laws set a higher age, that age applies.
Dong Yup Shim (CEO) · blocrown@airony.xyz. You can report privacy violations or get advice from the following Korean bodies: Personal Information Dispute Mediation Committee (개인정보분쟁조정위원회, 1833-6972), Personal Information Infringement Report Center (개인정보침해신고센터, 118), Supreme Prosecutors' Office (대검찰청, 1301), Korean National Police Agency (경찰청, 182).
When this policy changes, we announce it through in-app notices 7 days before the change takes effect (30 days before, for important changes). Previous versions are available on request. If the English or Japanese translation differs from the Korean original, whichever is more favorable to the user applies.