Privacy Policy

At a glance

winterlog studio ("we", "us") runs the game TTANG TTANG. This policy explains how we handle personal data in the web game (ttang.bang9.dev) and the iOS and Android apps.

• You can play as a guest without signing up. For online matches we keep a random player ID and your rating on our server, and your auto-generated nickname and chosen look are shown to other players in the same match.
• Signing in is only used to back up your progress in the cloud. The apps sign in automatically if Game Center or Play Games is signed in on your device.
• The apps show Google AdMob ads and use Google Analytics (Firebase) and Meta app events to measure ad performance. In the EEA, the UK and Switzerland we only request ads after you consent, and ad measurement is not turned on.
• Our game server (Cloudflare), purchase checks (RevenueCat) and ads, sign-in and ad measurement (Google, Apple, Meta) are US companies, so your personal data is transferred abroad.
• You can delete your data at any time in Settings → Account → Delete account.

Privacy contact

We are the controller of personal data for this game, and our privacy contact is the owner, Hyungu Kang. Send privacy questions, requests to see or delete your data, and complaints to:

• Business name: winterlog studio
• Owner: Hyungu Kang
• Address: 5-12 Gwangmyeong-ro 347beon-gil, Jungwon-gu, Seongnam-si, Gyeonggi-do, Republic of Korea
• Email: support@bang9.dev
• Phone: +82 10 9688 1157

Why we use your data

We rely on consent only for ads and for storing our analytics ID in the EEA, the UK and Switzerland, and for the advertising ID (IDFA) on iOS when you allow tracking; everything else is based on the grounds above. You can withdraw consent at any time as described in On-device storage and SDKs.

What we collect and where it comes from

• Created on your device: random player ID, auto-generated nickname, the animal, hat and trail you pick, paws (in-game currency) and items you own, match records, settings
• Sent to our server during online matches: player ID, online rating, nickname, look and step input
• When you sign in: a random ID for this game from the sign-in service (Game Center and Play Games automatically when the app starts; Google and Apple only when you tap their buttons), account ID, creation time, a copy of your progress
• Usage records: game events, screens and match results, device analytics ID, where you came from (site or ad), device language, country of access worked out from your IP address
• App purchases: store receipt (product, store, amount, country, time), RevenueCat anonymous ID, device analytics ID and the ad you came from. Only the store sees your card details
• App ads (Google AdMob SDK): advertising ID, approximate location estimated from your IP address, ad views and clicks, device and app information, ad consent status
• App ad measurement (Google Analytics for Firebase and Meta SDK, only while turned on): each SDK's random ID, app events (first open, usage time, match start and end, opening the checkout, sign-in and creating a new account — no nickname, rank or account ID), in-app purchases (product, amount, currency), IP address and approximate location (Google doesn't keep the IP), device information, advertising ID. The SDKs send this straight from your device to those companies
• Server access: IP address, access time, requested address, browser and app information
• Support email: email address, what you write, player ID (added automatically to Support emails)

Data kept only on your device

Paws, items you own, your look, match records and settings are stored on your device, and a copy is backed up to our server only when you are signed in. If you play as a guest without signing in, we don't send this data to our server; we only receive the player ID, nickname and look that online matches need. If you sign out in Settings → Account, or sign out of Game Center or Play Games on your device, the app stops signing in automatically. Uninstalling the app or clearing site data erases the data on your device; your ad consent choice stays in Google's consent tool (UMP) on your device.

How long we keep data and how we delete it

Where the law sets a retention period, the legal basis is shown in the table, and we keep those records separately and only for that period. When the retention period ends or the purpose is fulfilled, we delete the data without delay so it can't be recovered.

• Data on our server is deleted from the database. Deleting your account removes your account, linked sign-ins, cloud save and rating immediately (Delete Your Account).
• If you are a guest, we delete your rating within 10 days of your request.
• Our analytics records are linked only to a device analytics ID, so we can't pick out single records; they are deleted automatically when the retention period ends.

Who receives your data (third parties, processors, international transfers)

Third parties The companies below also use the data they receive for their own purposes, so this can count as disclosure to third parties.

• The sign-in services and app stores are ones you choose and have your own agreement with, so their privacy policies apply.
• Meta app events receive data to measure ads, and Meta also uses it under its own policy to choose and improve ads.
• When Apple or Google receives a refund request for something bought in the app, we send that store (US), through RevenueCat, whether the item was delivered and our view on the refund. This is not done in the EEA, the UK and Switzerland.
• If the law requires it, for example a court warrant, we disclose data only as far as the law requires.

Processors We entrust work to the providers below, and their data processing terms require our processors (those who do the processing on our behalf) to protect personal data to the same standard as this policy. Their sub-processors are listed by each provider, and if we change providers or what they do for us, we will update this policy.

We treat Google AdMob as ad work entrusted to Google, so it is in the table above. In the EEA, the UK and Switzerland we only request ads after you consent, but the SDK starts first to show the consent form, and at that point it may send device and app information to Google.

International transfers

• When and how: whenever you use the game or app, over an encrypted connection.
• Legal basis: Korean PIPA Art. 28-8(1)(3) (processing and storage needed to perform our contract, disclosed in this policy). For users in the EEA and the UK, data is protected by the adequacy decisions for Korea and, for US providers, by the EU-US Data Privacy Framework or standard contractual clauses.
• To refuse: don't sign in or delete your account, turn off ad tracking on your device, and turn off the game's Settings → "Send usage stats & ad measurement". Data sent to our game server (Cloudflare) is needed for online play, so refusing means you can't use online features (Practice mode works without the internet).

On-device storage and SDKs

The game stores your progress, settings and random IDs (player ID, device analytics ID) on your device. The apps include ad (Google AdMob), purchase-check (RevenueCat) and ad measurement (Google Analytics for Firebase, Meta app events) SDKs. On the web, when you tap the Google or Apple sign-in button, that company's sign-in window opens, and that company receives your IP address and browser information and can use its own cookies.

Storing your progress, settings and sign-in state is essential for the game and can't be turned off; it is removed when you uninstall the app or clear site data. To learn how Google uses data from partner apps, see How Google uses information from sites or apps that use its services. Third parties, including Meta, may use information from this app and elsewhere to measure ads and target ads; to opt out, use Meta's ad settings or your device's ad settings.

Consent and how to turn things off

• EEA, UK and Switzerland: before requesting ads, the app asks for consent with Google's consent form (UMP), and you can change or withdraw it in the game's Settings → "Privacy choices". Our own analytics stay off, and no analytics ID is stored, until you turn on "Send usage stats". The ad measurement tools are not turned on.
• Korea: data sent for ads, analytics and ad measurement is disclosed in this policy as use of processors, and we don't ask for separate consent.
• United States: for opting out of sale or sharing and for GPC, see Your Privacy Choices.
• Our analytics and ad measurement: turning off the game's Settings → "Send usage stats" ("Send usage stats & ad measurement" in the apps) stops them and deletes the analytics ID and the ad measurement tool IDs on your device.
• iOS tracking permission (ATT): when the ad measurement tools start, or before the first ad, we ask with the App Tracking Transparency prompt; if you don't allow it, we don't use the IDFA (installs from ads are counted with Apple's SKAdNetwork). You can change this in Settings → Privacy & Security → Tracking.
• Advertising ID: app ads and Meta app events use your advertising ID; Google Analytics uses only the IDFA, on iPhone, if you allow tracking. To turn it off: on Android, Settings → Google → Ads → Delete advertising ID; on iOS, Settings → Privacy & Security → Tracking → turn off TTANG TTANG. You will then see non-personalized ads.
• The game works the same if you don't consent or turn these off.

External Transmission Disclosure (Japan)

Under Art. 27-12 of Japan's Telecommunications Business Act, this lists the information the game sends from your device to other companies.

Children's data

This game is not directed at people under 13 (under 14 in Korea; in the EEA, under the age at which you can consent to data processing on your own in your country — 13–16, depending on the country). We don't ask for your age, don't collect names or contact details, and have no chat. If we learn that we have collected personal data from someone below this age, we delete it. Ads are shown the same way regardless of age, and you can turn off personalized ads in your device's ad settings. Parents and guardians can ask to see or delete data through Privacy contact, and can block purchases and tracking with the store's parental controls.

Your rights and how to use them

You can ask at any time to see, correct or delete your personal data, or to stop processing it, and you can withdraw consent; where the law provides, you can also ask for a copy to take elsewhere (portability) and object to processing.

• Delete your account: in the game, Settings → Account → Delete account (deleted immediately)
• Erase data on your device: uninstall the app; on the web, clear site data
• Change ad consent or turn off analytics: On-device storage and SDKs
• Other requests (see or correct data, delete a guest rating, get a copy of your cloud save): Settings → ✉️ Support (the email includes your player ID) or Privacy contact

We reply within 10 days, and if we need longer, we tell you why and when to expect an answer. To confirm it's you, we may ask for your player ID or to confirm your sign-in, and you can also make a request through a legal guardian or someone you authorize.

Your Privacy Choices

If you live in California or another US state with a similar law, you can opt out of the sale or sharing of your personal information as described below.

Do Not Sell or Share My Personal Information We don't sell personal information. When app ads (Google AdMob) and ad measurement in the apps (Meta app events) send your advertising ID, ad interactions and app events, this can count as "sharing" under some US state laws. There is no sale or sharing in the web game. To opt out:

• In the app: turn off the game's Settings → "Send usage stats & ad measurement".
• On your device: turn off your advertising ID (On-device storage and SDKs).
• Tell us: send "Do Not Sell or Share" to Privacy contact. We act on it within 15 business days and tell you the result.

Global Privacy Control (GPC) The web game doesn't sell or share, so a GPC signal changes nothing. The apps don't receive GPC signals, so please opt out as described above.

Appeals If we deny your request or you aren't happy with our answer, send "Appeal" to Privacy contact. We review it again within 45 days and tell you the result and our reasons; if it still isn't resolved, you can complain to your state's Attorney General.

App permissions

How we keep data safe

• All communication with our server is encrypted.
• We check that data from sign-in services is genuine and keep only the random ID.
• Only we can access the server and provider dashboards. Passwords and keys are kept in an encrypted secrets store.
• We check that purchase notifications are genuine to block fake purchases.
• We collect only what we need.

Where to get help

If you need help with a privacy problem in Korea, you can contact:

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
• Korean National Police Agency, Cyber Bureau: 182 (ecrm.police.go.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)

Users in other countries can complain to the authorities listed in the country sections below.

Changes to this policy

This policy (version 1) was announced on October 10, 2026 and takes effect on October 10, 2026. When we change it, we announce what changed on this page, side by side with the previous version, before the change takes effect (on the effective date at the latest); if a new purpose or recipient is added, we tell you before that processing starts and ask for consent where the law requires it.

Language

This document was originally written in Korean. Translations are provided for convenience. If they differ, the original prevails, unless the law of the country where you live says otherwise.

EEA, UK and Switzerland

• We are the controller (Privacy contact), and the legal bases are in the purposes table above: contract (GDPR 6(1)(b)), legitimate interests (6(1)(f)) and consent (6(1)(a)).
• You can object at any time to processing based on legitimate interests (our statistics, server security) under GDPR Art. 21; if you do, we stop unless we have compelling grounds.
• Your rights: access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21) and withdrawal of consent. Send requests to Privacy contact.
• Complaints: you can complain to the data protection authority where you live (in the UK the ICO, in Switzerland the FDPIC). UK users: if you send a complaint to us, we acknowledge it within 30 days, as the Data (Use and Access) Act 2025 requires.
• We don't make automated decisions or profiles that have legal effects on you.
• Switzerland: you have the same rights under the Federal Act on Data Protection, and transfers to US providers are protected by the Swiss-US Data Privacy Framework or standard contractual clauses.

United States (California and other state laws)

• Categories collected in the last 12 months: identifiers (player ID, advertising ID, sign-in ID, ad measurement tool IDs), commercial information (purchase records), internet activity (game events, ad interactions), approximate location (country, estimated from IP). Sources, purposes, recipients and retention are as in the tables above.
• Selling and sharing: we don't sell personal information for money. App ads (Google AdMob) and ad measurement in the apps (Meta app events) can count as "sharing"; to opt out, see Your Privacy Choices. We don't knowingly sell or share personal information of anyone under 16.
• Your rights: to know, delete, correct, and opt out of sale or sharing. We won't discriminate against you for using them, you can use an authorized agent, and we may ask you to verify your identity. To appeal a denial, follow Your Privacy Choices.
• Do Not Track: the web game has no third-party tools for ads or analytics, so nothing changes based on your browser's DNT signal.
• When we update this policy, we show the effective date.

Other countries

Users in the countries below have the rights their country's law gives them. Send requests and complaints to Privacy contact. Purposes and legal bases are in the purposes table above, and international transfers in the transfer table above.

• Japan: the business handling personal information is winterlog studio (represented by Hyungu Kang; address in the privacy contact section). Security measures are in How we keep data safe, and external transmission in External Transmission Disclosure (Japan). Foreign systems: we are in Korea, which has the Personal Information Protection Act; our providers are in the United States, which has no comprehensive federal privacy law but has state laws such as the California Consumer Privacy Act. Our providers' data processing terms set out security measures.
• Brazil: the controller (controlador) is winterlog studio, and the data protection officer (encarregado) is Hyungu Kang (Privacy contact). Legal bases (LGPD Art. 7): performance of a contract (V), legitimate interest (IX), consent (I, for ads that require consent). International transfers: Transferência internacional de dados pessoais.
• Mexico: the data controller (responsable) is winterlog studio (address in the privacy contact section). Primary purposes are the game, online matches, cloud save and purchase checks; secondary purposes are our statistics, ads and measuring our app ads. You can object to secondary purposes and to transfers for advertising by telling us or through your device's ad settings or the game's settings.
• Canada and India: our privacy officer (in India, grievance officer) is the owner, Hyungu Kang (Privacy contact).

International Transfers of Personal Data (Brazil)

Personal data of users in Brazil is transferred outside Brazil as follows.

• Recipients: us (winterlog studio, Korea) and the US providers in the table.
• Mechanism and legal basis: transfers needed to perform our contract (LGPD Art. 33, IX), providers' data processing terms and standard contractual clauses (Art. 33, II), and consent for ads that require it (Art. 33, VIII).
• Purposes and duration: see the purposes and retention tables in the Privacy Policy.
• Responsibility: we are responsible for protecting the transferred data.
• Your rights: you have the same LGPD Art. 18 rights; send requests to support@bang9.dev.
• Onward transfers: providers can pass data to their own sub-processors and the same level of protection is required by contract.