Privacy Policy

Information we collect

When you post a comment, your display name and profile photo are visible to other users.

• Account data: email address, display name and profile photo if you sign up with email or Google.
• Guest (non-member) usage information: simply viewing or playing games without signing up does not create an identifier or usage record on our servers, and guests' game progress is stored only in your browser's local storage. Only when a guest presses a game's "like" button does Firebase anonymous authentication create a random identifier (uid) that is stored in your browser; on our servers we then store only this identifier, the creation time, the last access time (updated at most once a day) and the "like" records. We do not collect information that directly identifies you, such as a name or email. Access logs (including IP address) remain in the server logs of Google's infrastructure, and their retention period follows the retention and destruction items below. Guests cannot post or report comments. If a guest signs in with Google, the same identifier is linked to the member account, so likes are kept. When you sign in as a member, progress in supported games is also saved to your account.
• Usage data: your subscription status, the games you own, your credit balance and history.
• Game save data (cloud save): information stored on your account when you sign in with Google and play a supported game (currently Cosmic Merge). Items: best score; lifetime statistics (games played, highest tier, best combo, number of merges and so on); unlocked achievements; discovered stars; daily reward record (last claim date and streak count); item (hammer) count; your own top 10 records (score, highest tier, date); settings (sound muted, tutorial and hint seen flags). Purpose: so you can continue on other devices, stored only as needed to provide the service. Only you can view it and it is not shown to other users. This information is separate from joining the ranking; no score is shown or sent to the ranking until you separately agree to join it. We do not store a device identifier, browser information or IP address in this record.
• Game data (Arpia Magic Academy, Game Farm, coming soon): until these games are available to members, we do not collect this information or store it on your account. Once available, information of members who use games that need an account is stored. Arpia Magic Academy: character display name (initially filled from your Google display name), track (story group), stats (level, experience, HP, MP, attack, defense, gold), inventory, known spells, current chapter, creation and update times. Game Farm: pet name (entered by you), species, personality traits, status values (hunger, affection), level, experience, creation and update times. Purpose: providing the game. Only you can view it and it is not shown to other users. Kept until you withdraw, and deleted when you withdraw or delete it yourself (within 10 days after identity verification if requested by email).
• AI features (coming soon): these games use Google's generative AI (Gemini) to write story and conversation text. Until this feature is available, we do not send the information below to the AI service. Once available, we send: the character's level, chapter and track; battle results (hit, damage, victory, level-up); the pet's name, species, traits and status values; and the messages you type to your pet. We do not send your Google account name or email address. We do not store your messages or the AI's replies (they stay only in your browser while you use the page). Do not enter personal information in conversations. AI-generated text may be inaccurate.
• Payment and order information (Applies from the day paid features start. We revise this policy and announce it before then.)
• Content you post: comments and likes.
• Device and usage data that our hosting and advertising partners receive automatically, such as IP address, browser type and pages viewed.

Comment service

1. Personal information processed

• When you post a comment: Google account identifier (uid), display name, profile photo address (URL), comment content, the game the comment is on, and the times it was posted, edited or deleted
• When a report is handled: the reporting member's identifier (uid), the reason for the report and the time of the report
• When a rights-infringement request is handled: the requester's name and contact details, the content of the request and supporting material
• When a comment is managed (action taken): the identifier (uid) of the member who wrote the comment, the action (hide, delete, restore and so on), the reason code and the rule item applied. We do not store a copy of the comment content.
• The record of your confirmation of the comment disclosure notice (time of confirmation) and records used to limit comments and reports (member identifier, request times and counts)
• Access logs generated automatically when you use the service: IP address, access time and request information (server request logs and sign-in logs). We do not store IP addresses in the comment itself.

2. Purpose

Providing and displaying the comment service, handling reports, temporary measures and objections, managing the record of actions, responding to rights-infringement requests and disputes; access logs are for service security and error handling

3. Who can see it

Display name, profile photo, comment content and posting time are public to everyone who uses the service. The information of a member who reports is not disclosed to other users, including the comment's author. Do not enter personal information in comments. Anything you enter in a comment is public.

5. Profile photo

We do not store the photo file; we store only the photo address (URL) provided by Google. Your browser loads the photo directly from Google's servers, so your IP address and similar data may be passed to Google at that time.

Retention periods and requests to access, correct or delete (items 4 and 6) are described below under "Retention and destruction".

Ranking (leaderboard) service

Ranking (leaderboard) service: processed only for members who signed in with Google and chose to join. Items: nickname, best score per game, time, ranking ID (an internal number linked to the account, not shown publicly), and the time of consent and the version of the consent text. Purpose: running the public ranking and preventing cheating. Basis: the member's consent, which is optional and can be withdrawn at any time; not consenting has no disadvantage for other services. Scores are sent to our server each time the member sets a new best score.

Public display: nickname, score and date (with rank for the top 50) can be seen by anyone, including visitors who are not signed in. Real name, email address, profile photo and account ID are not shown. Public information may remain in search engines or be copied or saved by others, and we cannot delete such copies. Do not put personal information in your nickname.

Ranking data: kept until the member chooses "Leave ranking" or withdraws, and deleted immediately then. If requested by email, deleted within 10 days after identity verification. If a member was barred from the ranking, the fact of the bar (a flag, a reason code and the time of action) is kept after leaving the ranking, to keep the bar in place, for as long as the account exists, and deleted when the member withdraws.

Moderation: nicknames or records that break the ranking rules in the Terms may be removed or a nickname reset by the operator, and a member who submits cheated records may be barred from the ranking. Scores outside plausible limits may be rejected automatically.

How we use it

• To provide sign-in, subscriptions, purchases and your game library.
• To keep the service secure and prevent abuse.
• To show advertising on free games (based on your consent or opt-out, depending on your region).
• To answer your messages and improve the hub.

Cookies and local storage

We store your language, theme, privacy choices, and game progress and cloud-save status information in your browser. Firebase uses storage to keep you signed in. We do not use analytics cookies.

Refusing cookies: you can refuse cookie storage in your browser settings; some features such as sign-in may then be limited.

Advertising and online behavioral information

Free games may show ads served by Google AdSense. In the European Economic Area, the United Kingdom and Switzerland, ads are loaded only after you consent, and personalized ads require separate consent. In South Korea we operate on notice under this policy plus an opt-out.

Online behavioral information: for advertising on free games, Google AdSense may automatically collect behavioral information such as ad views and clicks through cookies and advertising identifiers (collected by: Google). Purpose: serving and measuring ads and personalized ads (in the EEA, the UK and Switzerland only where you consent). How to refuse: Privacy choices in the footer or the Menu, your browser's cookie settings, or Google ad settings:

https://adssettings.google.com

Pro members and members who own a game see no ads.

Processors and overseas transfer

We do not sell your personal information.

• Processing and overseas transfer: authentication, database and hosting — Google LLC (Firebase, Google Cloud), Google data centers in the United States (Firestore multi-region nam5, Cloud Functions us-central1).
• When and how transferred: transmitted over the network when you use the service.
• Items: email, display name, profile photo, anonymous identifier, usage data, comments and likes, game save data, game data and AI inputs (character and pet information, conversation text) (once those games are available), ranking data (nickname, scores, ranking ID), comment content, report and moderation records, access logs (IP address).
• Purpose: sign-in, data storage and providing the service.
• Retention: until you leave the service or the processing contract ends. Comment-service data follows the periods in Retention and destruction. Game save data follows Retention and destruction.
• How to refuse and effect: if you do not want your data transferred overseas, tell us at contact+game@evoa.one. If you refuse the transfer, you cannot use sign-in and account features.
• Purpose of the AI transfer: generating story and conversation text (once those games are available). You can refuse the transfer; if you do, the AI-written text features cannot be used. Other game functions are not affected.
• Payments: Applies from the day paid features start. We revise this policy and announce it before then. Payment processor (card numbers are not stored by us). Items: payment and order information. Retained for 5 years (Article 6 of the Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce).

Retention and destruction

4. Retention and use periods

• Comments, display name and profile photo address: until the member deletes the comment or leaves. If the member deletes it directly, it is deleted immediately; a request to leave is handled and deleted within 10 days of the request. Backups we made are deleted within 30 days, and copies Google keeps while providing its service follow Google's published deletion schedule.
• Access logs (including IP address): kept for up to 30 days for service security, then deleted automatically.
• Hidden comments: kept until a decision follows the review; if the decision is to delete, they are deleted under the standards above.
• Comment disclosure confirmation record and rate-limit records: until the member leaves (deleted on leaving)
• Report records: 1 year from the last of report receipt, the operator's handling (hide, restore, delete), or the deletion of the reported comment or account. Even if a member leaves, the record of reports the member made (including the reporter identifier) is not deleted and is kept for this period. A comment that was automatically hidden after reports from three or more different users keeps that state in the comment and report records and follows the report-record period above.
• Rights-infringement request and temporary-measure handling records: 3 years after handling is complete (to respond to disputes)
• Comment-management (action) records: actions linked to a rights-infringement request, temporary measure, objection or dispute are kept for 3 years from the action, and other ordinary actions such as spam or rule violations for 1 year from the action, and are deleted automatically after the period. If a rights-infringement request or dispute is raised about an action recorded as an ordinary action, that record follows the 3-year standard. Even if a member deletes a comment or leaves, these records are not deleted; they are kept separately from other information for the period above, and during that period the identifier (uid) of the member who wrote the comment remains in this record after the member leaves.
• Game save data: kept until you withdraw, and deleted when you withdraw or delete it yourself with "Delete cloud save" (within 10 days after identity verification if requested by email). The copy stored in your device's browser is not deleted by us (except in the different-account case described in the Terms).
• Where the law requires the above records to be kept, they are kept separately from other information for that period.

6. Requests to access, correct, delete or leave

A member can delete their own comments directly and can leave directly with the "Delete account" button on the account page. When you leave, account information (identifier, email address, display name, profile photo address), the comments you wrote in all games, likes, game save data, game data (character, pets) (once available), ranking data (nickname, scores), records kept for usage limits, and the sign-in account are deleted; an account with credits, a subscription or payment history cannot leave with the button because payment records must be kept by law. In that case, if you cannot sign in, and for requests to access, correct, delete or stop processing personal information, send a request to contact+game@evoa.one from the email address of your Google account; we confirm your identity by checking that the address of the request email matches the email of the member account. After you leave, the report records and comment-management (action) records in item 4 are still kept for the stated periods. After confirming your identity, we handle the request within 10 days of receiving it and tell you the result. Information that other laws require us to keep is kept for that period, and we may decline to delete it even on request; in that case we tell you the reason.

• Guest identifiers and related records (last access time, like records) are deleted when the guest asks us to delete them or 30 days after the last access. Guests can delete their records themselves with the "Delete guest records" button on the account page.

Destruction: we destroy information without delay once its purpose is achieved, and permanently delete electronic files in a way that cannot be recovered. Information we must keep under other laws (contract and payment records 5 years, consumer complaints and disputes 3 years) is stored separately.

Privacy officer and your rights

Privacy officer: Ruby Kim (Representative) · contact+game@evoa.one. Requests to access, correct, delete or stop processing your data sent to this email are handled within 10 days.

Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict processing, and to withdraw consent.

Remedies for infringement: Personal Information Infringement Report Center 118, Personal Information Dispute Mediation Committee 1833-6972, Supreme Prosecutors' Office 1301, National Police Agency cybercrime reporting 182.

Children

EVOA Play does not allow children under 14 to sign up or pay, and confirms at sign-up that you are 14 or older. If we learn that personal information of a child under 14 has been collected, we delete it without delay.

Changes and contact

We may update this policy and will change the date above when we do. Questions about privacy can be sent to contact+game@evoa.one.