Starhatch Privacy Policy
This Policy takes effect on 2026-10-24. Until then, the previous policy (T4) (from 2026-10-20 · before that, T3, Korean) applies.
This Policy is used during the Philippines test launch. The items newly collected from T4 (advertising information sent to the ad company Google (AdMob) and purchase records) apply from the time you agree on the first launch after updating the Game. Google account linking (optional), added in T5, happens only when you link an account yourself (Article 2). Report and sanction records, added in T6, are created only when a user reports another user's name in the Game, or when the Operator takes action under the Operating Policy (Articles 2 and 3). It will be revised after expert review before the launch in Korea, and if it changes, we will notify you again in the Game.
Users in the Philippines: please also read the Additional Notice for Users in the Philippines at the end of this Policy.
This Policy is used during the Philippines test launch. The items newly collected from T4 (advertising information sent to the ad company Google (AdMob) and purchase records) apply from the time you agree on the first launch after updating the Game. Google account linking (optional), added in T5, happens only when you link an account yourself (Article 2). Report and sanction records, added in T6, are created only when a user reports another user's name in the Game, or when the Operator takes action under the Operating Policy (Articles 2 and 3). It will be revised after expert review before the launch in Korea, and if it changes, we will notify you again in the Game.
Users in the Philippines: please also read the Additional Notice for Users in the Philippines at the end of this Policy.
Studio KRK (the "Operator") processes the personal information of users of the mobile game Starhatch (the "Game") in accordance with the Personal Information Protection Act of the Republic of Korea and other applicable laws, and sets out this Privacy Policy as follows.
Article 1. Purposes of Processing
- Providing the Game — creating guest accounts, saving game progress, letting users who have linked a Google account continue on another device, preventing misuse such as tampering with in-game currency, and handling user reports about inappropriate names and other issues under the Operating Policy
- Improving the Game — finding the causes of app errors (crashes) and seeing, as statistics, at which steps users stop playing
- Measuring ad performance — measuring, for each ad, which ad led to the Game being installed and whether the tutorial was completed or the player came back the next day
- Providing ads — showing rewarded ads, confirming that an ad was watched to the end so the reward can be given, and preventing fraudulent viewing
- Selling paid items — verifying payments (receipt validation), delivering items, handling refunds, and keeping the transaction records required by law
- Protecting data — making backups in case of server failure or data loss
- Handling user requests — responding to requests to exercise your rights, such as access and deletion, and to inquiries
Article 2. Personal Information We Process
| Category | Items | How it is collected |
|---|---|---|
| Game account | Guest account identifier (an account number made from the unique ID your device gives this app) · time the account was created and time of last login | Automatically when you open the Game |
| Google account link (optional) | Google account ID (the unique number Google gives each account) · the email address, name and profile picture that come with a Google sign-in are deleted from the Operator's server right after linking or signing in, and are not used in the Game | Only when you tap [Link] under "Link Account" in Settings, or "Load Account" on the title screen, and then choose an account in the Google sign-in window · nothing is collected if you do not link |
| Game progress records | In-game name (nickname) · saved game data such as owned Hatches, currency and progress · records of in-game action requests (request type, time and result) | Automatically while you play · you enter your nickname yourself |
| Report and sanction records | Reports: the Game Account ID of the user who reported · the Game Account ID of the reported user (if a name was reported and several users have that name, the Game Account IDs of the users with that name) and their name (nickname) at the time of the report · the reason (chosen from a list) · where it was seen (chosen from a list, such as Championship Ranking) · time · the number of reports per day, to prevent misuse of reporting · the Operator's handling result and notes Sanctions: the action taken by the Operator (the name removed in a forced name change · suspension of use), the reason note and time | When a user taps [Report] in the Game · when the Operator takes action under the Operating Policy · there is no field for writing a report in your own words, and the name of the user who reported is not kept |
| Gameplay records (collected by the Operator) | Records of in-game actions (app launches, tutorial steps, battle results, screens opened, changes in currency and items, completed purchases (product and amount), ad impressions and viewing records, etc.) · in-game error messages · information attached to them: install number (randomly created by the app) · Game Account ID · session number · app version · device type (model, OS version) · game language · country (determined from the IP address when received; the IP address itself is not stored) | After you tap [Confirm & Start] on the "Privacy Notice" shown on first launch, the Game sends them automatically to the Operator's collection server |
| Ad performance measurement (AppsFlyer) | Advertising ID (Google Advertising ID) · device information (model, OS version, language, carrier, etc.) · IP address · install source information (install referrer) · install identifier created by AppsFlyer · records of app launch, tutorial completion, first capture and next-day return · payment amount and currency | After you tap [Confirm & Start] on the "Privacy Notice" shown on first launch, the AppsFlyer program (SDK) sends them automatically |
| Ads (Google AdMob) | Advertising ID (Google Advertising ID) · App Set ID · identifiers related to the account signed in on the device (if applicable) · IP address · device information (model, OS version, language, etc.) · app usage information (app launches, taps, ad impressions, clicks, video viewing records) · diagnostic information (app launch time, hang rate, energy use) · Game Account ID (to verify ad rewards) · app information (app name, version) | After you confirm "I am 14 or older" and tap [Confirm & Start] on the "Privacy Notice" shown on first launch, the Google Mobile Ads program (SDK) sends them automatically when it loads and shows ads |
| Payments (Google Play billing) | Order number · product · amount and currency · payment time · payment verification result · refund status · Game Account ID | When you pay, Google Play tells the app, and the Operator's server checks with Google that the payment is valid |
| Crash records (Firebase Crashlytics) | Records of app crashes (where the error occurred, app state at the time) · device information (manufacturer, model, OS version) · app information (app version, network type) · app usage time information · Crashlytics and Firebase installation identifiers | After you tap [Confirm & Start] on the "Privacy Notice" shown on first launch, the Firebase Crashlytics program (SDK) sends them automatically |
| Requests and inquiries | Email address · content of the request or inquiry | When you send us an email |
- We do not collect names, phone numbers, dates of birth or addresses. We also do not use location (GPS), contacts, photos or microphone permissions. Payment method information such as card numbers is received directly by Google; the Operator does not receive it.
- The Operator's servers (game server and collection server) do not record your IP address. The collection server only determines the country from the IP address and keeps that. AppsFlyer and Google (AdMob) may estimate your approximate location (country, city) from the IP address they receive.
- For the "I am 14 or older" confirmation on first launch, only whether you confirmed and when are stored, only on your device, and they are not sent to the Operator's server.
- Gameplay records, ad performance measurement, ads and crash records are neither collected nor sent before you tap [Confirm & Start] on the "Privacy Notice" shown on first launch.
- In ad slots, the Game shows Google AdMob ads or promotional videos for this Game. Payments are made only through Google Play billing.
Article 3. Retention Period and Destruction
| Item | Retention period | Destruction |
|---|---|---|
| Game account (including the linked Google account ID) and progress records (Operator's server) | Kept until you request account deletion, and deleted 3 years after your last login · deleted without delay if you request deletion | Deleted from server records (cannot be recovered) |
| Email address, name and profile picture that come with a Google sign-in | Not kept — deleted right after linking or signing in | Deleted from server records (cannot be recovered) |
| Report records (Operator's server) | Kept until the Operator finishes handling the report, and deleted 90 days after handling is finished · deleted after this period even if the reporting or reported account is deleted · the daily report count is deleted together with that account | Deleted from server records (cannot be recovered) |
| Sanction records (forced name changes · suspensions — Operator's server) | Kept while the account exists — to stop a removed name from being used again and to check whether a violation is repeated · the sanction stages of the Operating Policy start again from the first stage if there is no violation for 1 year after the last sanction | Deleted together with the account (cannot be recovered) |
| Backup copies (all game account and progress records) | Made once a day and kept for 7 days on the server · 30 days on Cloudflare R2 · 30 days on the Operator's PC | Deleted automatically when the period ends. Even after an account is deleted, it remains in backups already made for up to 30 days and is then deleted |
| Gameplay records (collection server · backup copies · Operator's PC) | Kept on the collection server for up to 30 days from receipt · kept in backup copies and on the Operator's PC for 2 years from receipt, then deleted | Files deleted from the server, the backup storage and the Operator's PC (cannot be recovered) |
| Payment and refund records (Operator's server) | Records of contracts and withdrawals, and of payments and item supply: 5 years (Article 6 of the Enforcement Decree of the Korean Act on the Consumer Protection in Electronic Commerce) — even if you delete your account, they are kept separately for this period and then deleted | Deleted from server records (cannot be recovered) |
| Ad performance measurement records (AppsFlyer) | Up to 24 months under AppsFlyer's policy | Deleted by AppsFlyer |
| Ad records (Google AdMob) | Under Google's policy — ad data left in server logs is anonymized by removing part of the IP address after 9 months and cookie (identifier) information after 18 months | Deleted or anonymized by Google |
| Crash records (Firebase Crashlytics) | Deletion of crash records and related identifiers begins after 90 days (Firebase policy) | Deleted by Google |
| Request and inquiry emails | Until the request or inquiry has been handled · records of complaints and disputes about payments and refunds: 3 years (same Article 6 of the Enforcement Decree) | Deleted without delay once handled (records of complaints and disputes are deleted after 3 years) |
| Records on your device ("I am 14 or older" confirmation, settings such as volume, install number, gameplay records not yet sent) | Until you delete the app | Deleted together with the app |
Electronic files are deleted in a way that cannot be recovered.
Article 4. Provision to Third Parties · Entrustment of Processing
The Operator processes personal information only within the purposes in Article 1 and does not provide it to third parties unless there is a legal basis or you have agreed. To run the Game, the Operator entrusts processing as follows.
| Entrusted to | Entrusted work | Storage location |
|---|---|---|
| Vultr | Running the game server and the gameplay-record collection server (hosting) | Seoul data center, Republic of Korea |
| Cloudflare, Inc. | Storing game server backups and copies of gameplay records (R2 storage) | Outside Korea — Article 5 |
| Google LLC | Analyzing app crash records (Firebase Crashlytics) | Outside Korea — Article 5 |
| AppsFlyer Ltd. | Measuring ad performance | Outside Korea — Article 5 |
| Google LLC | Serving ads and measuring their performance (Google AdMob — showing rewarded ads, measuring ad performance and preventing ad fraud) · information sent: advertising ID, IP address, device information, Game Account ID, app usage information (ad impressions, clicks, viewing records), etc. — the "Ads (Google AdMob)" items in Article 2 | Outside Korea — Article 5 |
Article 5. Transfer of Personal Information Outside Korea
The Operator transfers personal information outside the Republic of Korea for processing and storage as follows (Article 28-8 of the Korean Personal Information Protection Act). The "Privacy Notice" screen on first launch also tells you about this.
① Cloudflare — Backup storage
| Recipient | Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) · privacy contact privacyquestions@cloudflare.com |
|---|---|
| Destination country | Cloudflare data centers in the Asia-Pacific (APAC) region — this is the backup storage location setting checked by the Operator (2026-10-10); the specific country within the region is decided by Cloudflare |
| Items transferred | Server database backup files containing all the game account and progress records in Article 2 · copies of gameplay record files |
| Purpose | Storing backups in case of server failure or data loss |
| Timing and method | Once a day (04:00 Korea Standard Time) · sent over an encrypted internet connection (HTTPS) |
| Retention period | Database backups are deleted automatically 30 days after upload · copies of gameplay records are deleted 2 years after receipt |
| How to refuse and what happens | Backups are needed to run the Game, so they cannot be refused separately. If you wish to refuse, please stop using the Game and request account deletion — your data will also be removed from backups within 30 days after deletion |
② Google — App crash record analysis
| Recipient | Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) — Firebase Crashlytics |
|---|---|
| Destination country | The USA and countries where Google has data centers — Firebase does not let us choose a processing region, so data may be processed anywhere in Google's infrastructure |
| Items transferred | The "Crash records" items in Article 2 |
| Purpose | Analyzing the causes of app errors (crashes) |
| Timing and method | After you confirm the "Privacy Notice" on first launch, when the app starts and when an error occurs · sent over an encrypted internet connection (HTTPS) |
| Retention period | Deletion begins after 90 days (Firebase policy) |
| How to refuse and what happens | The Game currently has no way to turn off crash records alone. If you wish to refuse, please stop using the Game — nothing will be sent after that |
③ AppsFlyer — Ad performance measurement
| Recipient | AppsFlyer Ltd. (14 Maskit St., Herzliya 4673314, Israel) · privacy contact privacy@appsflyer.com |
|---|---|
| Destination country | Israel (where the company is located) and the countries where the servers AppsFlyer uses are located — under AppsFlyer's policy, its servers may be in several countries and the countries are not specified |
| Items transferred | The "Ad performance measurement" items in Article 2 |
| Purpose | Measuring ad performance (which ad led to the install, and whether key actions happened after the install) |
| Timing and method | After you confirm the "Privacy Notice" on first launch, when the app starts and when the actions above happen · sent over an encrypted internet connection (HTTPS) |
| Retention period | Up to 24 months (AppsFlyer policy) |
| How to refuse and what happens | You can delete the advertising ID in your device settings (Article 8) or ask AppsFlyer to opt you out (privacy@appsflyer.com or www.appsflyer.com/legal/opt-out/). You can keep playing the Game as usual even if you refuse |
④ Google — Ads (AdMob)
| Recipient | Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) — Google AdMob (Google Mobile Ads SDK) · privacy contact https://support.google.com/policies?p=privpol_privts |
|---|---|
| Destination country | The USA and countries where Google has data centers — Google has servers around the world, so data may be processed on servers outside the country where you live (Google policy) |
| Items transferred | The "Ads (Google AdMob)" items in Article 2 |
| Purpose | The same as the entrusted work in Article 4 (showing rewarded ads · measuring ad performance · preventing ad fraud) |
| Timing and method | After you confirm the "Privacy Notice" on first launch, when ads are loaded and watched · sent over an encrypted internet connection (HTTPS) |
| Retention period | Ad data left in server logs is anonymized by removing part of the IP address after 9 months and cookie (identifier) information after 18 months (Google policy) |
| How to refuse and what happens | You can delete the advertising ID in your device settings (Article 8), turn off personalized ads in Google "My Ad Center" (myadcenter.google.com), and request deletion through the contact page above. You can keep playing the Game as usual even if you refuse (deleting the advertising ID only stops personalized ads) |
Article 6. Your Rights and How to Exercise Them · Requesting Account and Data Deletion
- You may at any time ask for access to, correction of, deletion of, or suspension of processing of your personal information.
- How: please send your request by email to contact@studiokrk.com (Studio KRK Privacy Team). So that we can find your account, please include your in-game name (nickname), the type of device you use, and the date you last played.
- You can also request deletion of your Starhatch account and data by the same email. When you do, we delete your account and progress records and your gameplay records from the Operator's servers, and they are removed from backups already made within 30 days. Payment and refund records are kept separately for 5 years as required by law and then deleted (Article 3). You may also ask AppsFlyer directly to delete the measurement records it holds (Article 5 ③), and Google to delete the ad records it holds (Article 5 ④). A deletion menu will be added to the Game before the official launch.
- The Operator will tell you the result within 10 days of receiving your request.
- You may also exercise your rights through a legal representative or a person you have authorized.
Article 7. Personal Information of Children Under 14
- This Game is intended for people aged 14 or older, and on first launch we ask you to confirm "I am 14 or older." You cannot start the Game without confirming. Ad programs (SDKs) are not turned on before you confirm that you are 14 or older.
- The Operator does not knowingly collect personal information of children under 14, and if it learns that such information has been processed, it destroys that information without delay.
Article 8. Tools That Collect Information Automatically
- The Game contains programs (SDKs) from AppsFlyer (ad performance measurement — uses the advertising ID), Google AdMob (ads — uses the advertising ID) and Firebase Crashlytics (crash records), which automatically collect the items in Article 2 after you tap [Confirm & Start] on the "Privacy Notice" shown on first launch. Gameplay records are sent by the Game itself, not by an SDK, to the Operator's collection server, and they do not include the advertising ID, IP address or nickname.
- How to refuse the advertising ID (Android): on your device, go to Settings → Privacy (or Google) → Ads → Delete advertising ID (depending on the device and OS version, it may appear as "Reset advertising ID" or similar). You can keep playing the Game as usual after deleting the advertising ID. Deleting it stops personalized ads; ads themselves may still appear.
- The Game does not yet have a separate button to turn off measurement.
- This web page does not use cookies or visitor analytics tools.
Article 9. Security Measures
- Administrative measures: the only person who handles personal information is the Operator.
- Technical measures: encrypted communication (HTTPS) between the Game and the servers · server admin screens and databases are not exposed to the internet · the game app is blocked from writing directly to server storage · server access secrets are not kept in the code repository
- Operator's PC: the Operator's PC that keeps backup copies and gameplay records is protected by a login password and screen lock and is used only by the Operator. These records are not uploaded to the code repository.
- Physical measures: the servers are covered by the access controls of Vultr's Seoul data center.
Article 10. Privacy Officer
| Privacy officer (department) | Studio KRK Privacy Team |
|---|---|
| Contact | contact@studiokrk.com |
You can also report or seek advice about privacy violations at the following organizations in Korea.
- Personal Information Infringement Report Center: privacy.kisa.or.kr · 118 (within Korea)
- Personal Information Dispute Mediation Committee: www.kopico.go.kr · 1833-6972
- Supreme Prosecutors' Office: www.spo.go.kr · 1301 (within Korea)
- Korean National Police Agency (cybercrime reports): ecrm.police.go.kr · 182 (within Korea)
Article 11. Changes to This Policy
- If we change this Policy, we will announce it in the Game and on this page before it takes effect. Changes that add items collected, recipients, or destinations of transfers outside Korea will apply from the time we show you the changes and get your consent again on the first launch after you update the Game; we will not collect or send new items before you agree. Other changes will be announced from 7 days before they take effect.
- Previous policies: T5 (posted 2026-10-17 — replaced by this edition before it took effect · the Google account linking text of T5 is included in this edition unchanged) · T4 for the test launch (2026-10-20 — the edition before Google account linking and report records were described) · T3 for the closed test (Korean) (2026-10-13 — the edition without ad company SDKs or real payments · builds that have not been updated keep collecting only within the scope of that edition) · T2 (2026-10-12 — differs from T3 only in contact details) · T1 (2026-10-10 — the edition without measurement or crash-record tools · no build using that edition was distributed)
Additional Notice for Users in the Philippines
If you are in the Philippines, the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations also apply to the processing described in this Policy. This section adds what that Act requires. The items, retention periods, recipients and transfers outside Korea are the same as in Articles 2 to 5.
① Lawful basis for processing (Section 12 of the Act)
| Purpose (Article 1) | Lawful basis |
|---|---|
| Providing the Game · Selling paid items · Handling user requests | Necessary to provide the Game and the paid items you request under the Terms of Service (contract — Section 12(b)) |
| Keeping payment and refund records (Article 3) | Necessary to comply with a legal obligation (Section 12(c)) — the Korean Act on the Consumer Protection in Electronic Commerce |
| Improving the Game · Protecting data · Preventing misuse (such as tampering with in-game currency) and fraudulent ad viewing · Handling reports about inappropriate names | Our legitimate interests in keeping the Game working, secure and fair (Section 12(f)) |
| Measuring ad performance · Providing ads | Our legitimate interests in offering the Game free of charge with ads and finding out which ads work (Section 12(f)) — you can object to the use of the advertising ID at any time by deleting it (Article 8); ads themselves may still appear |
② Your rights (Sections 16 to 18 of the Act)
- Right to be informed — this Policy tells you what we process, why, for how long and to whom it goes.
- Right to object — you can object to processing based on our legitimate interests. To stop the use of the advertising ID for ads and ad performance measurement, delete it on your device (Article 8); for anything else, email us.
- Right to access — you can ask what personal information about you we process, where it came from, who received it and why, how it was processed, and when it was last accessed and changed.
- Right to rectification — you can ask us to correct inaccurate information.
- Right to erasure or blocking — you can ask us to suspend, withdraw, block, remove or destroy your information, including deleting your account and data (Article 6).
- Right to data portability — you can ask for a copy of your information in an electronic, structured and commonly used format.
- Right to damages — you can be compensated for damages caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of your information.
- Right to file a complaint — with the National Privacy Commission (④).
To exercise these rights, email contact@studiokrk.com in the same way as in Article 6. We will reply within 10 days. If you have died or cannot exercise these rights yourself, your lawful heirs and assigns may exercise them (Section 17).
③ Person accountable for compliance (Data Protection Officer)
The person accountable for our compliance with the Act (Section 21(b)) can be reached through the Studio KRK Privacy Team at contact@studiokrk.com. If you ask, we will tell you the name of the person designated.
④ Transfers and complaints
- Your information is processed in the Republic of Korea and transferred to the recipients and countries in Articles 4 and 5. We remain responsible for the information we transfer to them for processing (Section 21).
- If you believe your rights have been violated, please contact us first at contact@studiokrk.com so that we can resolve it. You may also file a complaint with the National Privacy Commission of the Philippines (www.privacy.gov.ph).