Hexpy Games (hereinafter referred to as "Company," "we," "us," or "our") is committed to protecting the freedom and rights of data subjects by complying with the Personal Information Protection Act and related laws and regulations to lawfully process and securely manage personal information. In accordance with Article 30 of the Personal Information Protection Act, we establish and disclose this Privacy Policy to inform data subjects about the procedures and standards for processing personal information and to promptly and smoothly handle related grievances.
This policy applies to all users worldwide, and users in certain regions may be provided with additional rights.
We process personal information for the following purposes. The personal information we process will not be used for purposes other than those stated below, and if the purpose of use changes, we will take necessary measures such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.
We collect and process the following personal information:
| Legal Basis | Collection Purpose | Items Collected | Retention Period |
|---|---|---|---|
| Personal Information Protection Act Article 15(1)(4) (Contract Performance) | Membership registration and service provision | Email address, Name | Until membership withdrawal (30-day recovery period after withdrawal) |
| Personal Information Protection Act Article 15(1)(4) (Contract Performance) | In-app purchase processing | Transaction identification information (provided by Apple/Google) | 5 years (E-Commerce Act) |
| Items Collected | Collection Purpose | Collection Method | Retention Period |
|---|---|---|---|
| Device information (OS, device model, unique identifier) | Service provision and error analysis | Automatic collection via Sentry | 90 days |
| App usage logs (error information, crash reports) | Service quality improvement | Automatic collection via Sentry | 90 days |
| Advertising identifier (IDFA/GAID) | Ad serving | Google AdMob | According to ad platform policy |
We restrict the processing of personal information of children under 14 years of age.
We retain and use personal information within the retention and use period prescribed by law.
| Category | Items Retained | Retention Period | Legal Basis |
|---|---|---|---|
| Member information | Email, Name | Until membership withdrawal | Service provision |
| Withdrawn member information | Email, Name | 30 days | Account recovery support |
| Transaction records | In-app purchase information | 5 years | E-Commerce Act Article 6 |
| Log data | Error logs, device information | 90 days | Service quality improvement |
We destroy personal information without delay when it becomes unnecessary due to the expiration of the retention period or achievement of the processing purpose.
We consign personal information processing tasks as follows for smooth business operations:
| Consignee | Consigned Tasks |
|---|---|
| Supabase, Inc. | Member authentication and data storage |
| Functional Software, Inc. (Sentry) | Error tracking and performance monitoring |
| Google LLC (AdMob) | Ad serving |
When entering into consignment contracts, we specify and document matters such as prohibition of personal information processing beyond the consignment purpose, technical and administrative protection measures, restrictions on re-consignment, management and supervision of consignees, and liability for damages in accordance with Article 26 of the Personal Information Protection Act, and supervise whether consignees safely process personal information.
If the content of consigned tasks or consignees change, we will disclose such changes through this Privacy Policy without delay.
We transfer personal information internationally as follows to provide services:
| Item | Details |
|---|---|
| Legal Basis | Personal Information Protection Act Article 28-8(1)(3) (Processing consignment) |
| Items Transferred | Uploaded images (temporary processing) |
| Country of Transfer | United States (Google Cloud servers) |
| Transfer Timing and Method | Immediately upon image generation request, transmission via encrypted network |
| Recipient | Google LLC (Gemini API) |
| Purpose of Use | AI image generation processing |
| Retention and Use Period | Immediately deleted upon processing completion (according to Google policy) |
| Item | Details |
|---|---|
| Legal Basis | Personal Information Protection Act Article 28-8(1)(3) (Processing consignment) |
| Items Transferred | Email address, Name |
| Country of Transfer | United States (Supabase servers) |
| Transfer Timing and Method | Upon membership registration, transmission via encrypted network |
| Recipient | Supabase, Inc. |
| Purpose of Use | Member authentication and data storage |
| Retention and Use Period | Until 30 days after membership withdrawal |
| Item | Details |
|---|---|
| Legal Basis | Personal Information Protection Act Article 28-8(1)(3) (Processing consignment) |
| Items Transferred | Device information, error logs |
| Country of Transfer | United States (Sentry servers) |
| Transfer Timing and Method | Immediately upon error occurrence, transmission via encrypted network |
| Recipient | Functional Software, Inc. (Sentry) |
| Purpose of Use | Service error correction and quality improvement |
| Retention and Use Period | 90 days |
If you do not wish for international transfer, you can proceed with membership withdrawal through the app's settings menu. However, since international transfer is essential for service provision, the service will be unavailable if you refuse.
We take the following measures to ensure the security of personal information:
Despite our best efforts, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
We collect advertising identifiers as follows to provide personalized advertising:
| Item | Details |
|---|---|
| Items Collected | Advertising identifier (iOS: IDFA, Android: GAID) |
| Collection Method | Automatic collection via Google AdMob SDK |
| Collection Purpose | Serving personalized ads |
| Retention Period | According to Google AdMob policy |
iOS:
Android:
Even if you refuse the collection of advertising identifiers, there will be no restrictions on service use, but general ads may be displayed instead of personalized ads.
Data subjects may exercise the following privacy-related rights against the Company at any time:
We have designated the following Privacy Officer to oversee matters related to personal information processing and to handle complaints and remedies for data subjects:
Data subjects may contact the Privacy Officer regarding any inquiries, complaints, or remedy requests related to privacy while using our services. We will respond to and handle your inquiries without delay.
Data subjects may apply for dispute resolution or counseling to the following organizations to receive remedies for personal information infringement:
Our app integrates with third-party services that have their own privacy policies:
Please review these third-party privacy policies. We are not responsible for the privacy practices of third parties.
If you reside in the European Economic Area (EEA), United Kingdom, or Switzerland, you are provided with the following additional rights and information under the General Data Protection Regulation (GDPR).
| Processing Activity | Legal Basis | GDPR Article |
|---|---|---|
| Membership registration and service provision | Contract performance | Article 6(1)(b) |
| In-app purchase processing | Contract performance | Article 6(1)(b) |
| Service improvement and analysis | Legitimate interests | Article 6(1)(f) |
| Ad serving | Consent | Article 6(1)(a) |
| Legal obligation compliance | Legal obligation | Article 6(1)(c) |
Legitimate Interests: Our legitimate interests are service quality improvement, security maintenance, and fraud prevention.
In addition to the rights in Section 10, you have the following rights:
Under GDPR Article 21, you have the right to object to processing of personal information based on legitimate interests. In such cases, we will cease processing the personal information unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
You have the right to file a complaint with the data protection supervisory authority in your country of residence regarding the processing of personal information.
Transfers of personal information outside the EEA are protected through appropriate safeguards such as:
For GDPR-related inquiries, please contact us at yeonwoo.jo@hexpy.games.
California residents have the following additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).
We have collected the following categories of personal information in the past 12 months:
| Category | Examples | Collected |
|---|---|---|
| Identifiers | Name, email address | ✅ Yes |
| Commercial information | Purchase records | ✅ Yes |
| Internet activity | App usage logs | ✅ Yes |
| Biometric information | Fingerprints, facial recognition | ❌ No |
| Geolocation data | GPS coordinates | ❌ No |
We do NOT sell personal information as defined by the CCPA.
We may share the following categories of personal information with third parties for advertising purposes:
We do not collect sensitive personal information as defined by the CCPA.
Under California Civil Code Section 1798.83, you may request information about personal information disclosed to third parties for marketing purposes once per year, free of charge.
You may exercise your rights by sending an email to yeonwoo.jo@hexpy.games or through the app's settings.
We may request additional information to verify your identity when exercising rights, and requests through authorized agents are also possible.
This Privacy Policy is effective from October 11, 2025.
If there are additions, deletions, or modifications to the content of this Privacy Policy, we will announce them through in-app notifications at least 7 days before the implementation of the changes.
However, if there are significant changes that affect data subject rights, such as changes to the items of personal information collected or purposes of use, we will notify at least 30 days in advance and obtain consent again if necessary.
Continued use of the service after the effective date of the revised Privacy Policy will be considered as consent to the revised Privacy Policy.
If you have any questions about this Privacy Policy or the processing of personal information, please contact us:
Email: yeonwoo.jo@hexpy.games
Company Name: Hexpy Games
Representative: Yeonwoo Jo
Address: 49-6, Maenami-gil, Salmi-myeon, Chungju-si, Chungcheongbuk-do, Republic of Korea
Response Time: Within 5 business days
Effective Date: October 11, 2025
Last Updated: October 11, 2025
Version: 1.0
© 2025 Hexpy Games. All rights reserved.