Privacy Policy

1. What we collect

Social sign-in (Kakao, Naver, Google): only the member ID each service gives us. We do not ask for your name, nickname, email, phone number, birthday or gender. Your Gachaaa nickname is the one you type in yourself.

Email sign-up (optional): your email address and your password, stored only as a one-way hash (scrypt) that no one, including us, can turn back into the password. Email codes expire in 10 minutes.

WhatsApp sign-in (optional, English site): your phone number is stored only as a one-way hash; the code itself expires in 10 minutes.

When you sign up: the nickname you choose and when you agreed to the Terms and this Policy.

While you play: owned cards, pulls, points and Pack Points history, daily bonus and turbine records, hunt results, ranking visibility setting and your avatar.

Automatically: a sign-in cookie, a cookie counting free trial packs, and your IP address and requested page (security and abuse prevention).

Payments: paid top-ups are currently switched off. If they return, order number, amount, payment method, the provider's transaction ID and (only if you register one) a refund bank account will be collected, and this Policy will be updated first.

2. Why we use it

Signing you in and telling accounts apart; restoring your account (signing in with the same social account brings back your cards and points); keeping your character, card and point records; showing rankings; preventing cheating and attacks; answering your questions.

3. How long we keep it

Account and play records: until you delete your account, then erased immediately.

Sign-in session: up to 180 days, removed at once when you log out.

Security log (IP and request): 30 days. IP-based rate limits: up to 1 day. Server access logs: up to 3 months.

Required by law: if you ever paid, payment and refund records are kept for 5 years and complaint records for 3 years (Korean e-commerce act); sign-in records for 3 months (Protection of Communications Secrets Act). These are kept separately, without your nickname, and deleted when the period ends.

4. Deleting your account

Profile → Delete account erases your nickname, email and password, linked social accounts, cards, points, records and sign-ins on every device immediately. This is different from logging out and cannot be undone. Only the legally required records above remain, without your name, until their period ends. You can also ask by email.

5. Companies that handle data for us

We do not give your personal data to anyone else unless the law requires it.

6. Your rights

You can view your data and history on your Profile, hide yourself from rankings, unlink social accounts, sign out other devices and delete your account at any time.

For anything else (access, correction, deletion, stopping processing) email [email protected]; we reply within 10 days.

Children under 14 cannot sign up.

7. How we protect it

HTTPS everywhere; sign-in tokens and phone numbers stored only as hashes; admin pages behind a password, rate limits and automatic blocking of attacks; access limited to the operator.

8. Cookies

Cookies are used only to keep you signed in and count trial packs; no advertising trackers. Visit statistics (Cloudflare Web Analytics) use no cookies. Blocking cookies in your browser means you cannot sign in.

9. Contact and complaints

Privacy officer: 서티파이 (Certifi) operator · [email protected]

You can also contact the Korean Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).