Privacy Policy

YW Lab (the "Company") values the personal information of users in providing the mobile game "Dear My Frog" (the "Service"), and has established and published this Privacy Policy in order to comply with the Personal Information Protection Act, the Telecommunications Network Act, the EU General Data Protection Regulation (GDPR), and other applicable laws and regulations.

This policy applies to the game. The website ywlab.dev does not use account registration, cookies, or visit-analytics tools; the hosting provider (Google Firebase Hosting) processes access logs (IP addresses).

1. Personal Information Collected

1-1. Required Information (Automatically Generated Upon Service Use)

To show the weather, the game may ask for permission to access your device location. You can use the game without allowing it; in that case, the weather is shown based on the approximate location derived from your IP address. You can turn off the permission at any time in your device's app permission settings.

1-2. Optional Information (When Using Google Sign-In)

• Google Sign-In is optional; the game may be played without registering.
• Additional items such as profile photo or date of birth are not collected.

1-3. Advertising Identifiers (Automatically Collected)

• Users may reset their Advertising ID or opt out of personalized ads in device settings (Android: Settings → Google → Ads).

1-4. Payment Information

• In-app purchases are processed through the Google Play payment system; payment details such as card or account numbers are not collected or stored by the Company.
• The Company receives only the payment receipt (order ID, product ID, purchase time) from Google, which is used solely to verify Diamond delivery.

1-5. Marketing Communications (Distinct from Operational Notifications)

Pursuant to Article 50 of the Telecommunications Network Act, the Company obtains separate prior consent before sending commercial advertising messages. The following notifications are operational service notifications, not marketing communications, and may be sent without the User's consent:

• Push notifications of support or wishes sent by other users (a core service feature)
• Gameplay notifications such as dispatch completion, booster expiry, and daily mission reset
• Required notices such as Terms or Policy updates, maintenance announcements, and service termination notices

The operational notifications above may be disabled in the in-game settings or device settings. Should marketing communications become necessary in the future, a separate consent process will be provided.

2. Purposes of Collection and Use of Personal Information

3. Retention, Use Period, and Destruction of Personal Information

• Game data: retained until account deletion or 1 year after last access, then deleted
• Payment receipt information: retained for 5 years pursuant to the E-Commerce Act
• Log data (access and error): retained for 3 months, then deleted
• Ad reward verification logs: retained for 6 months, then deleted
• Content moderation logs (records of reports and blocks of wishes/support messages): retained for 90 days, then deleted (for purposes of identifying repeat violators and addressing disputes)
• App usage statistics (Google Analytics for Firebase): user-level and event-level data are retained according to the Google Analytics data retention setting (2 months), then deleted. Aggregated statistics that cannot identify individuals may remain
• Location information: not sent to or stored on the Company's servers; kept only in device memory while the game is running and erased when the game is closed
• Inquiry emails: retained for 1 year after handling is completed, then deleted. However, pursuant to the E-Commerce Act, emails requesting withdrawal of a purchase or a refund are retained for 5 years, and emails handling payment-related complaints or disputes for 3 years

Upon receipt of an account deletion request, all data except items subject to the above retention periods is immediately destroyed.

3-1. Destruction Procedure and Method

• Destruction procedure: The Company destroys personal information without delay once the retention period has ended or the purpose of processing has been achieved. Personal information that must be preserved under other laws is stored separately from other personal information and used only for the purposes specified by those laws.
• Destruction method: Electronic files are deleted in a manner that prevents recovery or re-reading. Personal information printed on paper is shredded or incinerated.
• Personal information preserved under law: Payment receipt information (order ID, product ID, purchase time) is preserved for 5 years pursuant to Article 6 of the Act on the Consumer Protection in Electronic Commerce, Etc. and Article 6 of its Enforcement Decree (records on payment and the supply of goods, etc.). Emails requesting withdrawal of a purchase or a refund are preserved for 5 years pursuant to Article 6 of the same Enforcement Decree (records on contracts or withdrawal of offers, etc.), and emails handling payment-related complaints or disputes for 3 years pursuant to the same Article (records on consumer complaints or dispute resolution).

4. Disclosure of Personal Information to Third Parties

The Company does not disclose Users' personal information to third parties beyond what is stated in this Policy, except in the following cases:

• Where the User has given prior consent
• Where a lawful request is made by an investigative authority pursuant to applicable law and following proper procedures
• Where data is provided in a form that does not identify specific individuals, for purposes such as statistical analysis or academic research

5. Outsourcing of Personal Information Processing

The Company outsources personal information processing as follows for service operation:

• The Supabase database is stored in the Seoul Region of the Republic of Korea. However, because Supabase may access it from overseas for operation and support, it is also listed as an overseas transfer in 5-1.
• Details of the overseas transfer of personal information entrusted to Google services are set out in 5-1.
• Automated review of wish and support text using AI has not been implemented. If it is implemented, the Company will first add the processor and the overseas transfer details to this Policy and give notice through the procedure in Section 12.
• The Company does not send personally identifiable information, such as names or accounts, for IP location lookups or weather lookups.

5-1. Overseas Transfer of Personal Information (Personal Information Protection Act Art. 28-8)

To perform the contract for providing the game, the Company entrusts the processing of personal information to overseas businesses as described below, and discloses these details in this Policy pursuant to Article 28-8(1)(iii) of the Personal Information Protection Act. Website access logs and inquiry emails are also processed overseas as shown in the table below.

Note: Countries where Google data centers are located (as of September 24, 2026): the United States, Chile, Uruguay, India, Taiwan, Thailand, Japan, Malaysia, Singapore, Germany, the Netherlands, Belgium, Denmark, Finland, Sweden, Austria, Norway, Ireland, and the United Kingdom. Firebase services may also be processed in other countries where Google Cloud regions are located.

Apart from the methods listed under "How to Refuse and Effect" in the table, the overseas transfer alone cannot be refused. If you do not want your information transferred overseas, you may stop using the game and request account deletion and the deletion of your personal information using the methods in Section 6; in that case, you will not be able to use the game.

5-2. Lawful Basis for Processing — EU/EEA Users (GDPR Article 13)

The lawful basis for processing personal information of EU/EEA residents is as follows, pursuant to Article 6 of the GDPR:

• (a) GDPR Article 6(1)(a) — Consent: Processing based on the User's consent to this Privacy Policy and upon entering the game.
• (b) GDPR Article 6(1)(b) — Performance of a Contract: Processing necessary to deliver the game service (in-game currency, accounts, social features, cloud synchronization).
• (c) GDPR Article 6(1)(f) — Legitimate Interests: Processing for the purpose of preventing fraud and maintaining service security (ad abuse verification, security logs, moderation). Such processing is carried out only to the extent that it does not override the rights and freedoms of Users.

Where consent is the lawful basis, Users may withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

6. Rights and Obligations of Data Subjects and How to Exercise Them

Users may exercise the following rights at any time:

1. Right of Access: The right to access the categories of personal information being processed and the status of such processing
2. Right to Rectification and Erasure: The right to request correction of inaccurate information or deletion of personal information
3. Right to Restriction of Processing: The right to request that the processing of personal information be restricted
4. Account Deletion (Right to Erasure): The right to request permanent deletion of all personal information and game data (compatible with GDPR Article 17 "Right to Erasure")
5. Right to Data Portability: The right to receive one's data in a standard format (such as JSON) (GDPR Article 20)

Rights may be exercised by sending a request to the email address in Section 10. Account deletion can also be done through "Delete Account" in the game settings screen.

The Company will take action and notify you of the result within 10 days of receipt of your request. If the Company cannot take action within that period for a justifiable reason, it will notify you of the reason and the expected processing date within 10 days, and will take action without delay once the reason no longer applies. If the Company refuses a request or takes action on only part of it, it will also notify you of the reason and how to file an objection.

The same deadline applies to requests from residents of the EU and the United Kingdom. Even where processing is delayed, the Company will respond within one month of receipt of the request pursuant to Article 12(3) of the GDPR; where requests are complex or numerous, the Company may notify you of the reason within one month and extend the period by up to two further months.

A legal guardian or a person authorized by the User (an authorized agent) may also exercise these rights. In that case, please also send a power of attorney (a document stating the names and contact details of the person granting and the person receiving the authorization, the scope of the authorization, and signatures). The legal guardian of a child under age 14 may request access to, correction, deletion, or suspension of processing of the child's personal information.

The Company verifies that the person making the request is the User or a legitimate agent, and requests only the minimum information necessary for verification. If you disagree with the action taken, you may file an objection by the same email or apply for remedies to the agencies in Section 11.

7. Measures to Ensure Security of Personal Information

• Passwords: No passwords are collected (Google Sign-In only).
• Access Control: Supabase Row Level Security (RLS) policies ensure that Users can only access their own data.
• HTTPS Communication: All communication between client and server is encrypted using TLS 1.2 or higher.
• OAuth Security: State parameter verification is applied to prevent CSRF attacks during Google Sign-In.
• Log Minimization: In production builds, logs that may contain personal information (such as user IDs and OAuth URLs) are disabled.

8. Automated Data Collection (Cookies and Advertising Identifiers)

• This Service does not use web cookies.
• The AdMob SDK automatically collects the Advertising ID (GAID). Users may opt out by selecting "Reset Advertising ID" or "Opt out of Ads Personalization" in device settings. Opting out will continue to display ads, but they will be non-personalized.
• For app usage statistics, Google Analytics for Firebase stores an app instance ID on the device and sends usage records. There is no setting in the game to turn this off.
• This game is currently available only on Android (Google Play).

9. Personal Information of Children Under Age 14

• The Service is available to users aged 13 or older (per Google Play policy).
• Children under age 14 residing in the Republic of Korea require the consent of a legal guardian pursuant to Article 22-2(1) of the Personal Information Protection Act, and therefore may not consent to account registration (Google Sign-In) or the collection and use of personal information, and may not use the cloud data storage feature.
• If it is confirmed that a child under age 14 has registered, the account will be immediately deleted and all personal information will be destroyed.
• Children under age 13 residing in the United States may not use this Service pursuant to the Children's Online Privacy Protection Act (COPPA), and account registration is blocked by Google Play's age-13-and-older policy. If such a child is confirmed to have registered, their information will be immediately destroyed.

10. Personal Information Protection Officer

The Company has designated a Personal Information Protection Officer pursuant to Article 30 of the Personal Information Protection Act to take overall responsibility for personal information processing and to handle complaints and remedy harm for data subjects:

• Name: Kim Soonhak (김순학)
• Title: Representative
• Email: soonhak@ywlab.dev
• Response deadline: Within 7 business days for general inquiries; within 10 days of receipt for rights requests under Section 6

Business information required under the E-Commerce Act — including the company name, business registration number, business address, and mail-order business registration number — is available on the Google Play Store page and within the game settings menu under "Business Information."

11. Remedies for Infringement of Rights

Users may apply for dispute resolution or consultation with the following agencies to seek remedy for personal information infringement:

• Personal Information Dispute Mediation Committee: 1833-6972 (no area code) / www.kopico.go.kr (opens in new tab)
• Personal Information Infringement Reporting Center: 118 (no area code) / privacy.kisa.or.kr (opens in new tab)
• Supreme Prosecutors' Office Cyber Investigation Division: 1301 (no area code) / www.spo.go.kr (opens in new tab)
• National Police Agency Cyber Investigation Bureau: 182 (no area code) / ecrm.cyber.go.kr (opens in new tab)

EU residents have the right to lodge a complaint with the supervisory authority in their country of residence pursuant to the EU GDPR.

California residents may exercise the following rights under the California Consumer Privacy Act (CCPA/CPRA):

• Right to Know what personal information is being processed
• Right to Delete personal information
• Right to Opt-Out of the sale or sharing of personal information — This Service does not sell Users' personal information to third parties.
• Right to Non-Discrimination for exercising rights

Rights may be exercised by contacting the Personal Information Protection Officer via email listed in "10." above.

12. Changes to This Privacy Policy

When adding, deleting, or modifying the contents of this Policy, the Company will give notice through in-game notices or push notifications and a notice at the top of this page, starting 7 days before the effective date (30 days before for changes unfavorable to Users). Changes are recorded in the revision history in the Supplementary Provisions, and previous versions remain available.