| Firebase Authentication — Google LLC, United States | Guest identifier and authentication/security data such as IP address and user agent, for guest authentication and abuse prevention. | Encrypted network transmission during authentication and reauthentication after completing the age and guardian process. | Authentication data until deletion of the associated user is requested. Google describes removal from live and backup systems within 180 days after deletion, and retention of authentication IP logs for a few weeks. | Refusing essential authentication prevents online play. support@vacoz.com / Google Cloud Data Protection Team. |
| Firestore and Cloud Functions — Google Cloud Korea LLC (Korea), Google Asia Pacific Pte. Ltd. (Singapore), Google LLC (United States) | Game identifiers, app/device, language/time-zone, progress/reward/purchase-verification records; guardian request ID, approval, dates, notice version, review reference and connection-security records. Online play, verification and approval checks. Account-deletion requests, status, deadlines and the minimal linkage needed to verify ownership of the account are also processed. | Game storage and function execution use Seoul. Service and approval checks use encrypted communications such as HTTPS. Necessary Google operations, security, support and subprocessors follow the official list linked below. | Our records follow the 14-, 90- and 365-day criteria and separate entitlement/legal retention in section 6 of the Privacy Policy. After our deletion instruction, Google’s internal deletion process may take up to 180 days under the Cloud DPA. Minimal account-deletion ownership linkage is kept only while the account exists, removed on account deletion and never reused to authorize gameplay. | Refusing essential game or approval processing prevents the related online features. support@vacoz.com / Google Cloud Data Protection Team. |
| Android App Check and Play Integrity — Google LLC (United States), Google Asia Pacific Pte. Ltd. (Singapore) and the official Google subprocessor list | App/device attestation material and verification tokens, to protect server access and prevent abuse. | Encrypted transmission for integrity checks and protected requests in approved online mode. The service-specific official list below identifies Google’s operations and support countries. | App Check does not retain attestation material; attestation-provider terms apply. Ordinary tokens are used during their validity. Google describes up to 30-day retention for tokens used with replay protection, if used. | Refusing essential integrity checks prevents protected online features. support@vacoz.com / Google Cloud Data Protection Team. |
| iOS app integrity checks (App Attest) — Apple Inc. (US-based). Google recipients for Firebase App Check are identified in the preceding row. | Verification identifiers and attestation information establish that the app and device are legitimate. Basic connection information such as IP addresses may also be processed during communication. | When app verification is needed after the age/guardian process, the app communicates with Apple and sends the attestation result to Google App Check. Apple explains that personal data is generally stored by Apple Inc. in the US and may also be processed in other countries through Apple affiliates worldwide. See Apple’s information below for responsible entities and international transfers. | App Check does not retain attestation material. Apple explains that it retains information as needed for service, security and other processing purposes, and deletes it when related legal or business retention needs end. Its privacy information explains retention, deletion and how to exercise your rights. | Refusing essential app verification prevents protected online features. support@vacoz.com / Apple privacy contact: https://www.apple.com/privacy/contact/ . |
| Support iCloud Mail — Apple Services Pte. Ltd. (iCloud contracting provider for Korean users, Singapore); Apple Inc. (United States) and processing entities in Apple’s official privacy information | Email, inquiry, request ID, game UID, minimum verification information, guardian name, relationship, signature, date and consent document; for support, privacy requests, guardian checks and consent evidence. | Messages pass through the email service when you send support mail or we reply. Our operations system collects bodies and attachments addressed to support@vacoz.com. Access within our company is limited to the representative. Apple states that personal data is generally stored by Apple Inc. in the US; actual service processing follows Apple's official privacy information. | Unapproved applications: at 14-day expiry or final rejection; ordinary enquiries and rights requests: 90 days after actual closure; signed evidence: 90 days after withdrawal/expiry. Legal/dispute exceptions are separated. Collected copies, originals, attachments and trash require separate deletion checks; iCloud's default 30-day trash period is not mandatory additional retention. | Email submission is optional. The dedicated form accepts parental consent and privacy-rights requests; email is not required for iOS in-app account deletion. If necessary authority cannot be verified, the process cannot be completed. support@vacoz.com / Apple privacy contact: privacyoffice_korea@apple.com. |
| Dedicated intake and operations server — Vercel Inc. (US); execution region Singapore | Contact email, request type, details, IDs, UID, verification information, guardian signatures and attachments, connection and security records. Intake, authority checks, processing and retention management. | Submitted forms use HTTPS. Received support-email bodies and attachments are collected into the operations server once daily. Server execution is configured in Singapore; Vercel's US and global-infrastructure processing follows its official policies. | Company-managed originals and attachments follow section 6's 14/90/365-day and legal/dispute rules. Vercel's own security and operational records also follow its purpose and legal-obligation criteria. | You may decline the dedicated form. If necessary authority or consent cannot be verified, the process cannot be completed. support@vacoz.com / privacy@vercel.com. |
| Operations database — Neon; Databricks, Inc. (US, parent of Neon, LLC); database region Singapore | Intake and collected-support originals, contacts, status, signed documents and attachments, minimal verification and deletion records. Encrypted storage, task processing and retention management. | Stored over encrypted connections in the Singapore database during intake processing or support-email collection. Operational, support and subprocessor processing follow Neon's contract and Databricks' official subprocessor list. | Company-managed originals and attachments follow section 6's record-specific rules. Database recovery history, backups and providers' own security and statutory records are managed separately from operational-database deletion. The Neon operational database has a six-hour recovery-history retention setting. Deletion from the operational database does not instantly erase that recovery history, whose expiry is checked separately. | If necessary intake storage is refused, we cannot receive or verify that form request. General enquiries and alternative-intake assistance: support@vacoz.com / Databricks privacy contact: privacy@databricks.com. |