Privacy Policy

VACOZ (“we”) processes personal data for Just a little frog (개굴헤딩 / ケロケロヘディング / 呱呱頂球), the official website vacoz.com and customer support for this game. This notice describes the data, purposes, external services and your rights.

Taskmy app, purchase and licensing services have a separate Taskmy Privacy Policy. Distribution and payment platforms such as Google Play also apply their own privacy policies to data they process independently.

Google Play distribution is limited to the supported countries and regions shown in the store. We determine distribution after reviewing additional local age, consent and game-service requirements, and expand it after the necessary arrangements are in place.

• Guest and technical data: an automatically generated Firebase guest identifier without separate name or email registration; app, device and installation identifiers; connection and verification times; platform, app version, device and operating system information; system language, a language-based region code and time zone. Using a guest identifier does not make all associated records anonymous.
• Game data: scores and best scores, play sessions and combos, coins and duckweed, items, costumes, equipped items, upgrades, quests, rewards, spending records, verification results and unusual-use review records.
• Purchase data: product, order and transaction identifiers; receipts and purchase tokens used for verification; grant, restoration and entitlement status; and verification times. Verification data is transmitted to our server and the payment platform. Duplicate-grant prevention records store purchase identifiers, including a hash of the purchase token. Payment-method details are processed by the payment platform.
• Advertising, analytics and diagnostics: advertising and other device identifiers, ad requests, impressions and interactions, app launches and usage events, crashes, errors and diagnostics. Google and other SDKs may process IP addresses and infer an approximate region. The game does not provide a feature that requests precise GPS location.
• Website data: web hosting and content-delivery infrastructure may process request logs, including IP addresses, requested paths, browser information and request times, as necessary to serve and secure the website.
• Support and privacy-intake data: contact email, request type and details, receipt and processing times and status, app request ID or game UID, necessary ownership-verification code, notice and consent versions, and signed documents, screenshots or other attachments you submit. General-support email bodies and attachments are also collected into our operations system. Copying game support information places it on the device clipboard; copying alone does not automatically send it to us.
• Age and guardian-consent data: the date-of-birth-based age check is processed on the device. The under-16 approval process uses an app request ID, installation-possession verification information, approval, expiry and withdrawal status, and the notice version. A guardian’s submitted name, relationship to the player, email, signature, date and signed document are handled through restricted support procedures to verify legal authority and evidence consent. Approval-check communications may also produce basic connection and security records, such as IP addresses.
• Deletion-request data: account-linked requests, receipt/processing/completion or cancellation status, deadlines and minimal ownership-verification records. iOS in-app requests are received without a support email and handled by our team.

Data is collected automatically when you use the game, website or service requests, or supplied when you purchase or contact us. The game’s language-based region code and an ad SDK’s IP-based region estimate are different from GPS location.

• Identifying a guest state, operating the game and verifying daily state and rewards
• Verifying purchases, granting currency, confirming and restoring the remove-ads entitlement, and preventing duplicate grants and payment abuse
• Detecting unusual use, protecting services, investigating crashes and errors, and improving reliability
• Analysing game use and improving features and localization
• Delivering and measuring advertising and handling advertising choices required in the relevant region
• Customer support, privacy requests, payment disputes and legal obligations
• Providing an age-appropriate mode, verifying legal guardian authority and consent, renewal and withdrawal, and handling privacy rights requests

We distinguish processing with an applicable lawful basis other than consent, such as necessary service and purchase processing or legal obligations, from advertising or analytics processing requiring consent under applicable law. The permitted processing depends on law, your choices and the actual service configuration.

• Google Firebase Authentication, Firestore and Cloud Functions: guest authentication, game and purchase verification records, and server processing
• Firebase App Check: app/device integrity and protected verification requests using Google Play Integrity on Android and Apple App Attest on iOS
• Google Analytics for Firebase: game launch and usage analysis
• Firebase Crashlytics: crash, error and diagnostics analysis
• Google AdMob and User Messaging Platform (UMP): ad requests, display and measurement, and advertising privacy choices
• Unity Ads (AdMob mediation and bidding): ad delivery and measurement, and advertising fraud prevention
• Google Play and Apple App Store: distribution, payments, purchase verification and platform refund procedures
• Vercel: website and dedicated-intake hosting, content delivery, server execution and security. Neon (Databricks): encrypted storage of intake and support records and attachments. Apple iCloud Mail: general-support and existing in-app support emails. Our operations system collects received message bodies and attachments and manages their retention.

Optional usage analytics through Google Analytics for Firebase and diagnostics through Firebase Crashlytics are off by default. They are separate from essential game and security processing and are used only when the relevant permission conditions and choices allow them. Under-16 mode does not use them. Turning off optional usage analytics and crash reporting does not stop connection, verification and operational error records needed to provide secure, reliable authentication, game-data storage and server requests.

On iOS, only players aged 18 or over who allow personalization and tracking in advertising privacy choices are asked for iOS system app-tracking permission. Advertising tracking is used only if you also grant that permission. If refused, we do not use advertising tracking; ads, where they can be served, are non-personalized. Under-16 mode has no ads. Players aged 16–17 are not asked for tracking permission and cannot enable advertising tracking or personalization. Optional usage analytics and crash reporting are off by default and follow their respective permission conditions and choices.

Advertising services may process and share identifiers, ad interactions, purchase-related information and diagnostics for ad delivery, analytics and fraud prevention. The specific processing depends on service settings, applicable law and your choices.

Necessary data may be transmitted to these services. Processing on our behalf is distinguished from a provider’s own platform or advertising processing. We do not provide a feature for selling personal data. Advertising and platform providers may process information under their own policies; please also read their linked notices.

We use external services for the essential processing below and distinguish this from advertising providers’ own advertising processing. The standard online Google Cloud terms for a Korean billing address identify Google Cloud Korea LLC and the relevant Google Asia Pacific Pte. Ltd. contractual context. Processing recipients include Google LLC in the United States; paying in Korea does not mean all data stays in Korea.

Apple privacy, international transfers, retention and deletion information

Google’s official subprocessor list identifies Google LLC in the US, Google Asia Pacific Pte. Ltd. in Singapore, Google Cloud Korea LLC in Korea, and service-specific operations/support entities and processing countries. Relevant service and region rows apply; this does not mean game records are copied to every listed country. The Google Cloud subprocessor link below provides legal names, addresses, countries, activities and changes. Google’s processing contact is https://support.google.com/cloud/contact/dpo .

Permitted Google advertising, analytics and diagnostics in the 16-and-over mode involve Google LLC (US) and relevant Google entities; Unity Ads involves Unity Technologies S.F. (US, DPO@unity3d.com). Ad requests/interactions, identifiers, purchase-related and diagnostic information are transmitted when permitted SDKs and ad requests run, for delivery, measurement and fraud prevention. Firebase describes Crashlytics retention of crash data and identifiers for 90 days before removal starts. Analytics/advertising retention follows service settings, purpose, legal obligations and disputes. Unity’s policy describes relevant processing countries, including the US, Israel, Canada, Japan, New Zealand, Korea, Switzerland and UK, and safeguards. Under-16 mode does not use these ads or optional analytics/crash processing.

The website and dedicated privacy-request service use hosting, content delivery and server execution by Vercel Inc. (US, privacy@vercel.com). The intake server runs in Singapore. Following a homepage link does not send a signature, UID or verification code; request details and attachments are transmitted over encrypted connections when you submit the dedicated form. IP address, path, browser and time may be processed for delivery, security and abuse prevention. We send no separate usage-analytics events. A Singapore server region does not limit all Vercel connection, security or operational processing to Singapore; US and infrastructure processing follow its official privacy and subprocessor information.

Essential game/support processing follows applicable lawful grounds, such as contract performance, and required notices; where separate consent is required, we obtain it first. Guardians first receive the information above with the reference/version applicable to their request, with separate essential-processing and international-transfer choices. Advertising/analytics choices and withdrawal can be requested through privacy settings and support; refusing essential processing affects the related features.

We do not add the game-account identifier, raw installation-possession secret, date of birth or guardian-signature photos to these app-integrity requests sent to Apple. Verification identifiers and connection records are separate. These requests are also distinct from our game-server and support channels that handle approval and deletion requests.

We retain information under the criteria below for service operation, purchase rights, security, support and legal obligations. After the purpose ends, retention expires or a lawful deletion request is processed, we delete or de-identify it without undue delay, except necessary legally retained records. You can request deletion before the period ends through the dedicated form or the in-app route below. For general enquiries or help using the form, contact support@vacoz.com.

• Inactive guest profiles and device mappings with no purchase records or ongoing disputes: retained for 365 days after the last valid activity.
• Detailed records of ordinary game requests and daily verification: retained for 90 days after creation. Purchase evidence, enforcement decision evidence and administrator access records for personal-data systems are managed separately.
• Minimum decision evidence for confirmed abuse cases: retained for 365 days after the investigation closes. If an appeal or dispute is ongoing, the necessary retention period is assessed separately.
• Contact information, submissions and attachments for ordinary enquiries and deletion, access, correction or consent-withdrawal requests: 90 days from the first actual closure. Reopening a record or editing it does not extend the period. Single-use deletion-verification codes and copied email bodies in our operations system that may contain them are removed at closure. Original mailbox messages remain subject to separate retention and deletion verification. Statutory consumer-complaint and dispute records are managed separately.
• Minimum information needed to maintain or restore a valid remove-ads entitlement: retained separately for as long as needed to maintain or restore that entitlement and excluded from the 365-day inactive-guest cleanup above.

• Unapproved guardian-application originals and attachments: deleted when 14 days from receipt expire or rejection becomes final. We verify actual status so approved or renewed evidence is not deleted as an unapproved request. Minimum records required by law or an ongoing dispute are held separately.
• Guardian approval is valid for 365 days from issuance and is checked again at renewal. Signed consent evidence is retained while approval is active, then deleted 90 days after the earlier of withdrawal or expiry. Renewal is handled as new evidence and does not simply extend the old evidence's deadline. Legal and dispute records are managed separately for their restricted purposes.
• Minimal deletion-ownership linkage: the account identifier and minimum records needed to verify installation possession and approval are kept only while the account exists. After signed guardian-consent evidence is deleted 90 days after withdrawal or expiry, this linkage can still establish ownership for deletion of that account. It cannot be reused to authorize online play. Deleting the account also removes the linkage.

• Uninstalling the app, clearing its data or changing devices does not automatically delete Firebase server or purchase-verification records. Ordinary progress is primarily stored on the device and can be lost through those actions.
• Where the applicable Korean electronic-commerce rules require retention, display and advertising records are kept for six months, contract and cancellation records and payment and supply records for five years, and consumer complaint or dispute records for three years. These periods apply to the relevant statutory records, not to all gameplay records.
• Legally retained records are kept separately with restricted purposes and destroyed when the retention basis ends. Electronic records are deleted using methods that prevent recovery or reproduction; paper records, if any, are destroyed appropriately.
• Game analytics and diagnostics processed by providers such as Google and Unity, and hosting request logs, are also subject to the service configuration and provider retention and deletion policies.

Our operations system checks retention once a day and removes expired request originals, attachments and collected email-body copies. Legal or dispute holds, approval-state mismatches, incomplete collection and deletion errors require operator review; unverified deletion is not marked complete. An old email's receipt date alone does not classify guardian evidence as an unapproved 14-day application.

Deletion of the operational database, collected attachments, original iCloud messages and recovery copies is checked separately. Removing an operational record does not mean that every original, trash item or backup disappears immediately. iCloud's default 30-day trash period is not an additional mandatory retention period. Recovery copies have restricted access and are used only for disaster recovery; retention deadlines and deletion markers are reapplied before restored data is used. Providers' own security and statutory records also follow their contracts and official policies.

The retention deadline itself is not extended. Records due for deletion are processed at the first daily check after the deadline (09:30 Korea Standard Time); the check interval may introduce up to one day of processing latency.

The Neon operational database has a six-hour recovery-history retention setting. Deletion from the operational database does not instantly erase that recovery history, whose expiry is checked separately.

Under applicable law, you may request access, correction, deletion, restriction, withdrawal of consent and other rights available in your region. Submit privacy-rights requests through the dedicated form; iOS account deletion can also be requested in the app as described below. Send general enquiries to support@vacoz.com. Do not submit passwords, full card numbers, raw purchase tokens or unnecessary copies of identity documents.

iOS: request account deletion in the app

The platform-specific deletion features below are available from planned new app versions that include them.

1. In the game, open “Settings” → “Delete data” and read the account-deletion notice.
2. Confirm and submit the request in the app. You do not need to compose or send an email. The app shows the request status and completion deadline after receipt.
3. Our team processes deletion of the account and server game data within 7 calendar days of receipt, including weekends and public holidays. Check status in the app and cancel there before processing starts. Play and cancellation are unavailable once processing starts.

Android: request deletion by email with a verification code

1. In the game, select “Settings” → “Delete data”.
2. Read the notice and select “Create request email” to generate a single-use deletion-request verification code linked to your current game UID. The code is valid for 14 days after issuance.
3. Your mail app opens a draft containing the UID, verification code and expiry date. Review it and send it yourself to support@vacoz.com.
4. Support verifies your identity or legal guardian authority, reviews the deletion scope and retention exceptions, and informs you of the outcome.

If you use an older version or cannot use in-app intake or generate a verification code, you may contact support@vacoz.com directly. On iOS, a previously approved child may use in-app deletion after guardian approval is revoked or expires if the approval and installation-possession information still on the device can establish ownership of that account. If this cannot be verified or guardian verification is needed, the legal guardian should contact support. Include only the request and minimum information needed, such as the game UID or order identifier. Knowing a UID alone does not establish deletion authority; we may request further verification.

See section 6, “Retention, deletion and local resets”, for the treatment of server records, legally retained transaction and dispute records, and remove-ads purchase entitlements.

After necessary limited verification, we respond within the time and manner required by law. If a legal retention obligation or another valid reason prevents fulfilment, we explain the reason. Legal guardians and authorized representatives may also exercise rights as permitted by law.

• Where advertising privacy choices are provided, use “Ad privacy settings” in the game settings to view or change the available choices. This does not mean that the menu controls analytics collection by every service.
• Review advertising identifier and personalization options in the privacy or advertising settings of your device.
• Game verification may automatically hold or reject some requests. Contact support to request review of a restriction or verification result.

Submit a privacy request using the dedicated form

1. Open the dedicated request form on this page and select parental consent, consent withdrawal, deletion, access or correction.
2. Enter your contact email, the minimum necessary request details and the app request ID or game UID. Put an app-issued deletion-verification code only in its dedicated field; do not repeat it in free text or attachments.
3. Parental consent requires a signed document after reading the detailed notice and the 64-character request ID. You may attach one PDF, PNG or JPEG file up to 4 MiB.
4. Keep the receipt confirmation. Submission alone does not approve consent, revoke it or delete an account. An operator verifies authority and actual status before processing. Existing app email routes and iOS in-app deletion remain available.

The age and guardian process below is the operating standard for a planned new release and applies from app versions that include it. Our operating policy requires legal guardian verification and consent for players under 16, including those aged 12 and under. In app versions with this process, online play, Firebase authentication and game-data processing do not start until guardian approval is confirmed. Separate processing necessary to request and check approval, and basic connection and security records, may still occur.

After guardian approval, under-16 mode uses only processing essential to online play and security; it does not use ads, optional usage analytics or crash reporting, or cash in-app purchases. Advertising and analytics choices in the 16-and-over mode follow separate privacy settings. Our under-16 rule does not replace every country’s age and consent requirements.

A legal guardian first reads the parental-consent guidance below and the operator's detailed essential-processing and international-transfer notice, then submits the signed document and the app's 64-character request ID through the dedicated form. Submission alone does not grant approval. Our operator verifies parental authority, documents and actual approval status. The blank form remains available to download or print on this website. Contact support@vacoz.com if an existing app opens an email draft or you need help using the form.

Guardian approval is valid for 365 days from issuance and must be renewed for continued use. A legal guardian can use the dedicated form to withdraw consent or request access, correction or deletion. Once approval is revoked, the app blocks online use when it next checks approval, including at launch or activation. Legally retained records and the deletion scope are explained separately.

We use technical and organizational measures including access restrictions, protected transmission and server-request verification. Purchase and game-state checks support security and abuse prevention. No system eliminates every risk; please also protect your device and payment-platform account.

We update this notice and its date when data processing, features, external services or law changes. Material changes are communicated before they take effect through the website or other reasonable means. Changes requiring additional consent follow the applicable procedure.

Privacy enquiries and rights requests: VACOZ customer support, support@vacoz.com. Use this contact for access, deletion, restriction and international-processing enquiries.

You may contact the relevant privacy authority in your region for advice or dispute resolution. In Korea, the Privacy Infringement Report Center is available at privacy.kisa.or.kr or 118, and the Personal Information Dispute Mediation Committee at kopico.go.kr or 1833-6972.