Privacy Policy

Article 1. Purposes of Processing Personal Information and Legal Bases

The Operator processes personal information only to the minimum extent necessary to provide the Service. The main purposes of processing and their legal bases are as follows.

If a purpose of processing changes, the Operator will take the measures required by applicable laws and update this Policy.

Article 2. Personal Information Processed and Methods of Collection

Depending on the actual features of the Service, the following information may be processed.

The Operator does not directly collect Google or Apple account passwords or the original details of app store payment methods, such as users’ full credit card numbers or bank account numbers. Because the game does not display the UID to users, customer support identifies accounts by Nickname.

The Service is currently not designed on the premise of phone number verification, contacts, precise GPS location, photo or video uploads, microphone input, or user-generated content features such as free-text chat or posts (the speech bubbles in 1:1 Duels can only be chosen from sentences predefined by the game). If such features are added in the future and the scope of personal information processing changes, this Policy will be updated before those features are provided.

Article 3. Information That May Be Made Visible to Other Users, Such as Rankings

To provide rankings and competitive content (all-time highest stage, all-time best archery score, and this week’s and last week’s standings in the weekly Archery Challenge), the Nickname, score and rank, together with the character’s appearance (outfit, shoes, hair and eyes; Bow and Bow Costume; Bowstring), Inner Power realm, Bow amplification level, enhancement level of the Bow shown in the portrait, equipped Bow and archery Title level may be made visible to other users. Email addresses, login provider identifiers, payment identification information and the like are not made public in the rankings.

In 1:1 Duels, the following information may be shown to other users. (1) To other users in the same lobby while you are on the lobby list with ‘Accept challenges’ turned on: Nickname, archery Title level, character appearance, a rounded value of your duel power (shown on screen as the opponent strength category and the winner chest probability), and the time you joined the list. You are removed from the list when you use other content, the Mailbox, summons or purchase windows, leave the app, or lose your connection. (2) To your duel opponent: Nickname, archery Title, character appearance, the score and result of each arrow, and the speech bubbles you choose (sentences predefined by the game). If account deletion is completed while a duel record still exists, the Nickname and appearance in that record are erased and you are shown to the opponent as ‘Deleted user’.

Last week’s archery rankings, once settled, are displayed with the Nicknames in use at the time of settlement. When account deletion is completed, that account’s records are deleted from the rankings; in last week’s rankings that have already been settled, only the Nickname and account identifier are erased and the rank and score entry is kept so that other users’ ranks do not change. If deletion was requested through the Android app or by other means, the account may continue to appear in the rankings during the 7-day deletion waiting period.

If a different game account is started on a device that was using a Guest account (where, from the Guest account, the user logged in with a Google or Apple account already linked to another game account, or deleted the Android app or cleared its app data and started again), the previous Guest account can no longer be accessed; its Nickname is therefore released and becomes available to other users, and the account is excluded from the rankings (in last week’s settled rankings, as with account deletion, only the Nickname and account identifier are erased and the rank and score entry is kept). The game progress data of that account is not deleted. This does not apply where the app is reinstalled on iOS (iPhone or iPad) and the same Guest account is accessed.

When a Nickname and coupon code are entered on the coupon redemption page of the official website, the person who entered them is shown the official spelling of the Nickname of the account using that Nickname, that account’s highest stage, and whether that account has already used the coupon entered, so that rewards are not sent to the wrong account by mistake. Because the recipient account is determined by Nickname without login, coupon rewards sent by another person who entered the Nickname are also delivered to that account’s Mailbox. UIDs, email addresses and Member Codes are not displayed, and accounts pending deletion or restricted from receiving rewards are shown with the same message as a Nickname that does not exist.

Article 4. Processing and Retention Periods of Personal Information

The Operator retains personal information for the period necessary for the purposes of processing and, once the purpose has been achieved or the account has been deleted, destroys without delay any information that applicable laws do not require to be retained. All times below are in Korea Standard Time (KST, UTC+9).

The retention periods of information processed independently by external service providers may be governed by each provider’s applicable policies and laws.

Article 5. Provision of Personal Information to Third Parties

The Operator does not sell users’ personal information. As a rule, the Operator processes personal information within the scope of the purposes of processing set out in Article 1 and does not arbitrarily provide personal information to third parties, except where the user has given separate consent or where there is a basis in law.

The relationships for processing personal information when external businesses such as Google and Apple provide authentication, app store payments, advertising, cloud, push notification, app protection and other functions are explained below under “Outsourcing of Processing and External Services” and “Overseas Transfer”.

Article 6. Outsourcing of Personal Information Processing and Use of External Services

The Operator uses the following external services to operate the Service. Some of these businesses may process personal information as processors (outsourcees) acting on the Operator’s instructions, and others as businesses that independently provide app store, login or advertising services.

Name resolution (DNS) for the official website domain (boomukgames.com) is provided by Cloudflare, Inc. Since October 13, 2026, all delivery of the website’s pages and files and all handling of connections have been performed by Google Firebase Hosting, and Cloudflare does not relay or analyze visitors’ web requests.

The “Community” button in the in-game Settings opens the official Naver Cafe (cafe.naver.com/archergirl) operated by NAVER Corporation (the “Notice” button opens a notice window within the game). The app does not pass game account information to Naver in this process, and the processing of personal information in connection with joining and using the Cafe is governed by Naver’s privacy policy and the Cafe’s operating policy.

The Operator does not use separate error reporting services such as Crashlytics and does not connect Google Analytics to analyze usage behavior. If external services are added or the items processed change, the Operator will check the items actually processed by the relevant service and then update this Article together with the privacy disclosures submitted to the stores.

Article 7. Overseas Transfer of Personal Information

The Operator uses global service providers for login, server storage and processing, backups for failure recovery, advertising, app store payments, push notifications, app integrity verification, customer support email and the provision of the website, and in this process personal information may be transferred to and processed outside the Republic of Korea. Where an overseas transfer takes place on a basis permitted by applicable laws, such as outsourcing of processing or storage necessary to perform a contract, the Operator discloses the details of the transfer in this Policy.

If a user refuses the overseas transfer for essential authentication, server and app store functions, it may be difficult to use some or all of the Service, such as the relevant login method, server saving and payments. Users can end their use of the Service and request deletion of the related personal information through account deletion or customer support. Promotional push notifications, which are optional, are no longer sent once consent to receive them is withdrawn.

Privacy contacts of the recipients: Google LLC (Firebase, Google Cloud, AdMob, Google Play, Google Workspace and Firebase Hosting, including the sub-processor Fastly, Inc.) — Google privacy contact form · Apple Inc. — Apple privacy contact page · Unity Technologies — DPO@unity3d.com

Because the global processing locations and sub-processors of external businesses may change in the course of operating their services, the Operator regularly checks the providers’ current privacy and data processing documents and the actual configuration of the services, and keeps this Policy up to date.

Article 8. Automatically Collected Information, Advertising Identifiers and Behavioral Information

1. The game uses only rewarded ads that users choose to watch, and does not use banner or interstitial ads. The Google Mobile Ads SDK and similar components may automatically process IP addresses, app and ad interactions, diagnostic information, and device and account identifiers such as the Android advertising ID and App Set ID, in order to provide and measure ads and prevent fraudulent use.
2. Android users can reset or delete their advertising ID through the device’s ads privacy settings. The iOS app does not request App Tracking Transparency (ATT) permission and therefore does not access the advertising identifier (IDFA).
3. In regions where consent for advertising is required by applicable laws, such as the European Economic Area and the United Kingdom, the app asks whether the user consents through Google’s consent management tool (User Messaging Platform) when the app is launched, and loads ads only if ad requests are permitted. In the iOS app, users in regions where this consent is required are shown an “Ad privacy choices” button at the bottom of More → Settings, which they can use to review and change their choices at any time. The Android app does not currently have this menu. Where any other processing requires separate consent under applicable laws or platform policies, the Operator provides the necessary means to give or refuse consent.
4. The Firebase SDK included in the app contains Google’s measurement component, so technical information such as the app instance identifier and app launches and sessions may be sent to Google, and the in-app purchase SDK (Unity IAP) and the Unity engine may send diagnostic information on the payment process and hardware statistics to Unity. The Operator does not use this information to analyze user behavior.
5. The app protection SDK (NHN AppGuard) and Firebase App Check automatically check for app tampering, abnormal execution environments and app integrity while the app is running. Detection results of the app protection SDK are used only for record-keeping purposes, and use is not restricted on the basis of these results alone.
6. The BOOMUK GAMES official website has no advertising or visitor behavior analytics scripts or cookies installed by the Operator. However, Google (Firebase Hosting) may process technical information such as the IP address of the connection to deliver and secure the site. To make the next entry easier, the coupon redemption page stores the Nickname of the account to which a coupon was last sent only in the user’s browser storage (localStorage). This value is used only as an input value the next time a coupon is sent and can be removed by deleting the site data in the browser; coupon codes and Member Codes are not stored.

Article 9. Processing of Personal Information of Children Under 14

1. The game’s age rating and the age standards for personal information protection are separate. Under the Personal Information Protection Act, the consent of a legal guardian is required in order to process the personal information of a child under the age of 14 on the basis of consent. The Service’s essential processing is based not on consent but on the performance of a contract and similar grounds (Article 1), and the only processing based on consent is the optional receipt of promotional push notifications and the ad consent requested in regions where consent is required by applicable laws (Article 8). The app currently has no procedure for obtaining or verifying the consent of a legal guardian.
2. The Service is not primarily intended for children under the age of 14 (Google Play target age: 13 and over), and the app has no separate age verification procedure. The optional consent to receive promotional push notifications shown at first launch is displayed regardless of age, so users under the age of 14 should not consent to this optional item without the consent of their legal guardian.
3. If the Operator becomes aware that a child under the age of 14 has consented to an optional item without the consent of their legal guardian, the Operator will take the necessary measures, such as stopping the sending of notifications based on that consent. Legal guardians may make requests through the contact points in Article 13.
4. If features requiring separate consent are introduced in the future for users under the age of 14, the Operator will first put in place explanations that are easy for children to understand and procedures for obtaining and verifying the consent of legal guardians, and will update this Policy.

Article 10. Rights of Users and Legal Guardians and How to Exercise Them

1. To the extent provided by applicable laws, users may request access to, transmission of, correction or deletion of, and suspension of processing of their personal information, as well as withdraw consent, among other things. Legal guardians of children under the age of 14 may also exercise rights regarding the child’s personal information in accordance with applicable laws.
2. Up to one Google account and one Apple account can be linked to a single game account (More → Settings → Account). There is no function to unlink a login account that has already been linked or to replace it with another external account, or to merge or transfer different game accounts. A Google or Apple account already linked to another game account cannot be linked; if a user selects such an account from a Guest account, the user can log in to that game account after a confirmation window. In this case, the original Guest account can no longer be accessed from the app.
3. A user who has lost a Guest account as described above may request its recovery through customer support. If an account-switch record remains on the server and the user’s identity is verified by the email address of the relevant Google or Apple account, the Operator moves that login link to the original Guest account. Game data is not copied or merged; if the login being moved is the only login of the current game account, the Operator, with the user’s consent, locks that game account instead of deleting it. When the game account that received the moved login is deleted, deletion of the locked game account is scheduled at the same time, and the locked account is deleted after the 7-day deletion waiting period has passed (where logins were moved to several game accounts, when the last of those accounts is deleted). Support may be limited where there is no switch record or 3 years have passed, or where sufficient identity verification is difficult.
4. Account deletion can be requested in the app under More → Settings → Account → Delete Account; on the deletion screen, the request is confirmed by entering the current character name exactly and going through a 5-second countdown. Guest, Google and Apple accounts can all request deletion in the same way. If the app cannot be accessed, the email request method described on the Account and Data Deletion page can be used.
5. Deletion requested in the iOS (iPhone or iPad) app proceeds immediately without a deletion waiting period and cannot be canceled. Deletion requested through the Android app or by email goes through a 7-day deletion waiting period. If the user accesses the account during the waiting period, the time remaining until deletion is shown, and selecting [Continue] cancels the deletion request and restores normal use. Once 7 days have passed, at the first daily 4:40 a.m. (Korea Standard Time) run thereafter, the account and game data, except information that must be retained under applicable laws, are deleted so that they cannot be recovered; once deletion processing has started, it cannot be canceled.
6. When deletion is completed, the character name is released and becomes available to other users (during the deletion waiting period, the account continues to hold it). If the user logs in with the same Google or Apple account after deletion is completed, the user starts with a new game account without the previous data. Merely deleting the app or logging out does not delete the account and game data on the server, and the data of a Guest account that can no longer be accessed because of a switch to another game account also remains until deletion is requested.
7. Under Google Play and Apple policies, account deletion is distinct from mere account suspension; in-app account deletion deletes the entire game account, including the linked Google and Apple logins, together with account-linked data that is not required to be retained under applicable laws.
8. When an account using Sign in with Apple is deleted, the Operator requests Apple to revoke authorization using the Apple authentication information it holds. If revocation fails due to a temporary error, the encrypted authentication information and Apple user identifier are used only to retry revocation for 14 days and are then destroyed at the next scheduled processing (up to approximately 15 days); if, in the meantime, the same Apple account has been linked to and is being used with another game account, authorization is not revoked so that the login of that account is not cut off. Regardless of the outcome of revocation, the Operator still fulfills its obligation to delete the account and game data it holds.
9. If the user stops using “Sign in with Apple” for this game in the Apple Account settings or deletes the Apple Account, a game account linked only to Apple login has its existing login invalidated and enters a 7-day deletion waiting state (canceled by logging in again during the waiting period and selecting [Continue]); for a game account also linked to Google login, only the Apple link and the Apple authentication information are deleted, and the game account and data are kept.
10. Logging out does not delete the account or game data; upon logout, the device’s push notification registration is removed (on Android, the game closes after logout; on iOS, it returns to the title screen). Guest accounts have no logout function, and a Guest account not linked to Google or Apple may become inaccessible if the app is deleted or the device is changed.
11. Users may choose not to consent to receive promotional push notifications in the consent window shown on first entry, and even after consenting may withdraw consent at any time in the game under More → Settings → Option → Push Notifications; withdrawal takes effect immediately. The Operator records the times of consent and withdrawal, does not send promotional notifications without consent and, even with consent, sends them only when both Korea Standard Time and the device’s local time are between 8:10 a.m. and 8:50 p.m. In addition, in accordance with Article 50(8) of the Act on Promotion of Information and Communications Network Utilization and Information Protection, the Operator reconfirms on the game’s start screen, every 2 years from the date of consent, whether the user consents to receive them (with notice starting 30 days before the confirmation deadline), and informs the user of the result of the choice (sender, date of processing, result of processing). If the user does not confirm by the confirmation deadline, the consent remains in effect, but promotional notifications are not sent until the user confirms again. The device’s notification permission can be turned off separately in the device settings.
12. To prevent fraudulent use, the Operator’s server automatically detects and evaluates signs of abnormal activity. Accounts for which different types of abnormal signs have been confirmed above a certain threshold may, without human review, be excluded from public display in the rankings and from weekly Archery Challenge rewards, and claiming of weekly challenge reward mail already issued is also put on hold (mail whose claim deadline passes before the measure is lifted cannot be claimed). In addition, until the measure is lifted, in 1:1 Duels such accounts are shown on the lobby list to, and matched with, only accounts subject to the same measure. This measure is not lifted automatically; it is lifted after review by the operations staff. Heavier use restrictions, such as restrictions on claiming mail or coupons or blocking the saving of an account’s game data, are imposed only after direct review by the operations staff. Separately, the server may automatically reject, or adjust to the permitted range, save or reward requests that are impossible under the game rules. Users may request an explanation of, or object to, such automated decisions through the contact points in Article 13, and the Operator will have a person review the matter again and inform the user of the result.
13. To prevent erroneous deletion or unauthorized deletion of another person’s account, the Operator may verify, to the minimum extent necessary, whether the requester is the user or a legitimate representative.
14. Separately from the account deletion procedure, if a user exercises rights such as correction or deletion of personal information under the Personal Information Protection Act, the Operator will investigate the request without delay in accordance with applicable laws, take the necessary measures and inform the user of the result. Information that must be retained under other laws may be stored separately for the relevant statutory period.

Article 11. Procedures and Methods for Destroying Personal Information

1. The Operator destroys personal information without delay when a reason for destruction arises, such as expiry of the retention period, achievement of the purpose of processing or account deletion. If an automatic destruction job scheduled for a set time cannot be completed due to a temporary failure, it is performed again in the next run.
2. Information that must continue to be retained under other laws is kept separately from other information or with restricted access for the statutory retention period, and is then destroyed.
3. Electronic files are deleted in a way that makes recovery or reproduction difficult. Destroyed information may remain in backup copies for failure recovery for the periods set out in Article 4, and is deleted automatically once those periods have passed. Backup copies are used only for failure recovery and for testing recovery procedures, and if the Service is restored from a backup, accounts that have already been destroyed are destroyed again using the destruction confirmation records. Separately stored backup copies are protected by a lock that prevents modification or deletion, so no one can delete them before the periods in Article 4 have passed.
4. Where paper documents are processed, they are destroyed by methods that make recovery difficult, such as shredding or incineration.

Article 12. Measures to Ensure the Security of Personal Information

The Operator implements measures appropriate to the scale and risks of the Service to prevent the loss, theft, leakage, forgery, alteration or damage of personal information.

• Use of encrypted communications such as HTTPS/TLS
• Access control for account and server data through Firebase authentication, database security rules and similar means (account data is saved only through server functions)
• Verification of requests from the genuine app using Firebase App Check, and detection of app tampering and abnormal execution environments using the app protection SDK
• Encrypted storage (AES-256-GCM) of Apple authentication information; storage of purchase tokens and the like as irreversibly transformed values instead of the originals; encryption of backup copies made immediately before server updates
• Minimization of administrator privileges and secure management of credentials and secret keys
• Verification of in-app purchases and rewarded ads; detection of abnormal use, cheating and abuse
• Review of error and security logs and remediation of vulnerabilities as needed
• Minimization of personal information processing that is unnecessary for providing the Service

Article 13. Chief Privacy Officer and Contact Information

Users may send inquiries, complaints and requests for remedies relating to personal information protection to the contacts above, and the Operator will endeavor to review and handle them without delay in accordance with applicable laws.

Article 14. Remedies for Infringement of Rights

If consultation, dispute mediation or a report regarding an infringement of personal information is needed, the following organizations are available.

• Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr
• Privacy Incident Reporting Center (KISA): 118 (no area code) / privacy.kisa.or.kr
• Korean National Police Agency: 182 (no area code) / ecrm.police.go.kr

Article 15. Changes to the Privacy Policy

This Policy may be revised to reflect changes in the Service, the status of personal information processing, applicable laws or platform policies. If there is a change that significantly affects users’ rights, users will be notified before it applies by a method they can easily check, such as an in-game notice, the official website or the official Cafe.