Privacy Policy

Effective date: October 10, 2026 (previous version effective September 30, 2026)

What changed: we added app error reports (Firebase Crashlytics) and app version/build details in purchase records (sections 1, 4 and 5).

Friendly Sophie (친절한 소피, “we”) operates the mobile game K-Defense (the “App”). This policy explains what information the App processes, why, for how long, and how you can exercise your rights. If the Korean and English versions differ, the Korean version prevails.

1. Information we process

• Anonymous user ID (Firebase) — created automatically on first launch to identify your game data.
• Game data — progress and save data (level, stage records, heroes and items, word-learning history, settings), nickname, country code and ranking scores, stored in Cloud Firestore for cloud save, restore and rankings.
• Linked account (optional) — if you link Google or Apple sign-in, the account identifier, email address and display name via Firebase Authentication (or Apple’s private relay address if you choose “Hide My Email”).
• Purchase records — store (Google Play / ONE store), product ID, order ID, a SHA-256 hash of the purchase token (never the token itself), test-purchase flag, outcome (granted, refunded, etc.), timestamp, user ID and app details (app version and build, operating system and version, language setting), used to verify payments, prevent duplicate grants and receipt reuse, restore purchases, handle refunds and troubleshoot.
• App error reports — when the App crashes or hits an error, Firebase Crashlytics automatically sends the error details and location, time, app version and build, device model, OS version, a Firebase installation ID and your user ID, so we can find and fix the cause. No advertising ID is sent.
• Server logs — request time, user ID and error details when you use server features such as purchase verification, for security and troubleshooting.
• Support emails — your email address and message (and nickname / user ID for deletion requests).

Payment card details are handled by Google Play and ONE store; we never receive them.

2. What we do not collect

The App does not access location, contacts, photos/files, camera or microphone, and does not ask for your real name, date of birth, phone number or address. Heart-recharge reminders are local notifications scheduled on your device; there is no push server. Word-picture packs are downloaded from Firebase Storage without sending personal information (your IP address is visible to Google’s servers as part of the connection).

3. Advertising

The App shows rewarded and interstitial ads through Google AdMob. Every ad request is tagged for child-directed treatment (tagForChildDirectedTreatment), requests non-personalized ads only, and limits ad content to rating G. No interest-based advertising or remarketing is used. Google may still process device identifiers and IP addresses for ad delivery, frequency capping, fraud prevention and reporting under Google’s policies. We do not receive this data.

4. Retention

• Account and game data: until you delete your account (immediately in the App, or within 7 days of an email request).
• Purchase records: 5 years, as required by the Korean Act on Consumer Protection in Electronic Commerce, even after account deletion.
• Complaint and dispute records: 3 years under the same Act.
• Server logs: deleted automatically after 30 days.
• App error reports: deleted automatically after 90 days (Firebase Crashlytics retention).

5. Sharing and processors

We do not sell or provide your personal information to third parties, except where required by law. We use the following service providers, which may store data outside Korea:

• Google LLC (USA) — Firebase Authentication, Cloud Firestore, Cloud Functions, Cloud Storage, Cloud Logging and Firebase Crashlytics (authentication, storage, purchase-verification server, error reports); AdMob (advertising); Google Play (payment verification).
• ONE store Co., Ltd. (Korea) — payment verification.

If you do not want this transfer, you can stop using the App and delete your account.

6. Your rights

You (or the legal guardian of a child under 14) may request access to, correction, deletion or suspension of processing of your personal information. Delete your account in the App under Settings → Delete account, or follow the account deletion guide. For other requests, email service@friendlysr.com. We will verify the requester and respond within 10 days.

7. Children

The App is designed for students, including children under 14. We process only what is needed to run the game and do not ask for names, birthdays or contact details. Under the Korean Personal Information Protection Act, where consent is required to process the personal information of a child under 14, it must come from a legal guardian; please link a Google or Apple account together with a parent. Guardians may request access, correction or deletion of their child’s data, or withdraw consent, by contacting us. For purchases by minors, see the Terms of Service.

8. Security

All traffic is encrypted (HTTPS/TLS). Database security rules restrict each player to their own game data. Purchase records are written only by the server, and purchase tokens are stored only as hashes. Store API secrets are kept in Secret Manager, not in code.

9. Contact

Privacy officer: Friendly Sophie (친절한 소피)
Email: service@friendlysr.com

10. Changes

We will announce changes in the App or on this website at least 7 days before they take effect (30 days for material changes). This policy is effective from October 10, 2026; the previous version was effective from September 30, 2026.