This is the English version of the Starhatch Privacy Policy. 한국어

Starhatch Privacy Policy

Operator: Studio KRK · Effective date: 2026-10-20 · Edition: Test launch (T4)

Studio KRK (the "Operator") processes the personal information of users of the mobile game Starhatch (the "Game") in accordance with the Personal Information Protection Act of the Republic of Korea and other applicable laws, and sets out this Privacy Policy as follows.

Article 1. Purposes of Processing

1. Providing the Game — creating guest accounts, saving game progress, and preventing misuse such as tampering with in-game currency
2. Improving the Game — finding the causes of app errors (crashes) and seeing, as statistics, at which steps users stop playing
3. Measuring ad performance — measuring, for each ad, which ad led to the Game being installed and whether the tutorial was completed or the player came back the next day
4. Providing ads — showing rewarded ads, confirming that an ad was watched to the end so the reward can be given, and preventing fraudulent viewing
5. Selling paid items — verifying payments (receipt validation), delivering items, handling refunds, and keeping the transaction records required by law
6. Protecting data — making backups in case of server failure or data loss
7. Handling user requests — responding to requests to exercise your rights, such as access and deletion, and to inquiries

Article 2. Personal Information We Process

• We do not collect names, phone numbers, dates of birth or addresses. We also do not use location (GPS), contacts, photos or microphone permissions. Payment method information such as card numbers is received directly by Google; the Operator does not receive it.
• The Operator's servers (game server and collection server) do not record your IP address. The collection server only determines the country from the IP address and keeps that. AppsFlyer and Google (AdMob) may estimate your approximate location (country, city) from the IP address they receive.
• For the "I am 14 or older" confirmation on first launch, only whether you confirmed and when are stored, only on your device, and they are not sent to the Operator's server.
• Gameplay records, ad performance measurement, ads and crash records are neither collected nor sent before you tap [Confirm & Start] on the "Privacy Notice" shown on first launch.
• In ad slots, the Game shows Google AdMob ads or promotional videos for this Game. Payments are made only through Google Play billing.

Article 3. Retention Period and Destruction

Electronic files are deleted in a way that cannot be recovered.

Article 4. Provision to Third Parties · Entrustment of Processing

The Operator processes personal information only within the purposes in Article 1 and does not provide it to third parties unless there is a legal basis or you have agreed. To run the Game, the Operator entrusts processing as follows.

Article 5. Transfer of Personal Information Outside Korea

The Operator transfers personal information outside the Republic of Korea for processing and storage as follows (Article 28-8 of the Korean Personal Information Protection Act). The "Privacy Notice" screen on first launch also tells you about this.

① Cloudflare — Backup storage

② Google — App crash record analysis

③ AppsFlyer — Ad performance measurement

④ Google — Ads (AdMob)

Article 6. Your Rights and How to Exercise Them · Requesting Account and Data Deletion

1. You may at any time ask for access to, correction of, deletion of, or suspension of processing of your personal information.
2. How: please send your request by email to contact@studiokrk.com (Studio KRK Privacy Team). So that we can find your account, please include your in-game name (nickname), the type of device you use, and the date you last played.
3. You can also request deletion of your Starhatch account and data by the same email. When you do, we delete your account and progress records and your gameplay records from the Operator's servers, and they are removed from backups already made within 30 days. Payment and refund records are kept separately for 5 years as required by law and then deleted (Article 3). You may also ask AppsFlyer directly to delete the measurement records it holds (Article 5 ③), and Google to delete the ad records it holds (Article 5 ④). A deletion menu will be added to the Game before the official launch.
4. The Operator will tell you the result within 10 days of receiving your request.
5. You may also exercise your rights through a legal representative or a person you have authorized.

Article 7. Personal Information of Children Under 14

• This Game is intended for people aged 14 or older, and on first launch we ask you to confirm "I am 14 or older." You cannot start the Game without confirming. Ad programs (SDKs) are not turned on before you confirm that you are 14 or older.
• The Operator does not knowingly collect personal information of children under 14, and if it learns that such information has been processed, it destroys that information without delay.

Article 8. Tools That Collect Information Automatically

• The Game contains programs (SDKs) from AppsFlyer (ad performance measurement — uses the advertising ID), Google AdMob (ads — uses the advertising ID) and Firebase Crashlytics (crash records), which automatically collect the items in Article 2 after you tap [Confirm & Start] on the "Privacy Notice" shown on first launch. Gameplay records are sent by the Game itself, not by an SDK, to the Operator's collection server, and they do not include the advertising ID, IP address or nickname.
• How to refuse the advertising ID (Android): on your device, go to Settings → Privacy (or Google) → Ads → Delete advertising ID (depending on the device and OS version, it may appear as "Reset advertising ID" or similar). You can keep playing the Game as usual after deleting the advertising ID. Deleting it stops personalized ads; ads themselves may still appear.
• The Game does not yet have a separate button to turn off measurement.
• This web page does not use cookies or visitor analytics tools.

Article 9. Security Measures

• Administrative measures: the only person who handles personal information is the Operator.
• Technical measures: encrypted communication (HTTPS) between the Game and the servers · server admin screens and databases are not exposed to the internet · the game app is blocked from writing directly to server storage · server access secrets are not kept in the code repository
• Operator's PC: the Operator's PC that keeps backup copies and gameplay records is protected by a login password and screen lock and is used only by the Operator. These records are not uploaded to the code repository.
• Physical measures: the servers are covered by the access controls of Vultr's Seoul data center.

Article 10. Privacy Officer

You can also report or seek advice about privacy violations at the following organizations in Korea.

• Personal Information Infringement Report Center: privacy.kisa.or.kr · 118 (within Korea)
• Personal Information Dispute Mediation Committee: www.kopico.go.kr · 1833-6972
• Supreme Prosecutors' Office: www.spo.go.kr · 1301 (within Korea)
• Korean National Police Agency (cybercrime reports): ecrm.police.go.kr · 182 (within Korea)

Article 11. Changes to This Policy

• If we change this Policy, we will announce it in the Game and on this page before it takes effect. Changes that add items collected, recipients, or destinations of transfers outside Korea will apply from the time we show you the changes and get your consent again on the first launch after you update the Game; we will not collect or send new items before you agree. Other changes will be announced from 7 days before they take effect.
• Previous policies: T3 for the closed test (Korean) (2026-10-13 — the edition without ad company SDKs or real payments · builds that have not been updated keep collecting only within the scope of that edition) · T2 (2026-10-12 — differs from T3 only in contact details) · T1 (2026-10-10 — the edition without measurement or crash-record tools · no build using that edition was distributed)

Additional Notice for Users in the Philippines

If you are in the Philippines, the Data Privacy Act of 2012 (Republic Act No. 10173) and its Implementing Rules and Regulations also apply to the processing described in this Policy. This section adds what that Act requires. The items, retention periods, recipients and transfers outside Korea are the same as in Articles 2 to 5.

① Lawful basis for processing (Section 12 of the Act)

② Your rights (Sections 16 to 18 of the Act)

• Right to be informed — this Policy tells you what we process, why, for how long and to whom it goes.
• Right to object — you can object to processing based on our legitimate interests. To stop the use of the advertising ID for ads and ad performance measurement, delete it on your device (Article 8); for anything else, email us.
• Right to access — you can ask what personal information about you we process, where it came from, who received it and why, how it was processed, and when it was last accessed and changed.
• Right to rectification — you can ask us to correct inaccurate information.
• Right to erasure or blocking — you can ask us to suspend, withdraw, block, remove or destroy your information, including deleting your account and data (Article 6).
• Right to data portability — you can ask for a copy of your information in an electronic, structured and commonly used format.
• Right to damages — you can be compensated for damages caused by inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of your information.
• Right to file a complaint — with the National Privacy Commission (④).

To exercise these rights, email contact@studiokrk.com in the same way as in Article 6. We will reply within 10 days. If you have died or cannot exercise these rights yourself, your lawful heirs and assigns may exercise them (Section 17).

③ Person accountable for compliance (Data Protection Officer)

The person accountable for our compliance with the Act (Section 21(b)) can be reached through the Studio KRK Privacy Team at contact@studiokrk.com. If you ask, we will tell you the name of the person designated.

④ Transfers and complaints

• Your information is processed in the Republic of Korea and transferred to the recipients and countries in Articles 4 and 5. We remain responsible for the information we transfer to them for processing (Section 21).
• If you believe your rights have been violated, please contact us first at contact@studiokrk.com so that we can resolve it. You may also file a complaint with the National Privacy Commission of the Philippines (www.privacy.gov.ph).