Privacy Policy

1. Personal Information Collected in the Last 12 Months

This policy describes the personal information processing practices of Celon Inc. (hereinafter "Pogl Play"), the operator of the Service. The categorization of items and rights guidance follow the California Consumer Privacy Act (CCPA/CPRA) and the California Online Privacy Protection Act (CalOPPA) to the extent applicable, and the mandatory personal information protection laws of the user's residence may also apply. Government-issued identification numbers, precise location information, and sensitive content such as health and beliefs are not normally required for regular use of the Service, so do not enter them. Content that users include directly in prompts, attached files, or inquiries may be processed. Card numbers are processed by the payment processor. The categories, sources, purposes of use, and retention criteria of information collected within the last 12 months are as follows.

2. Purposes of Use of Personal Information

• Service provision: running experiences, assigning multiplayer servers and invitations, attributing progress and ownership to accounts
• Safety: receiving and processing reports, blocking, sanctions, automated moderation
• Economy: accurate recording and reconciliation of coins, items, and creation limits
• Creation: execution of the process of creating experiences from prompts and guidance on causes of failure
• Quality and recommendations: ranking calculation through measured signals such as boot success rate, retention, and completion
• Service improvement and AI model training/evaluation (see Section 3 below)
• Customer support: handling inquiries and objections
• Legal compliance and dispute response

Pogl Play displays advertisements within the service only when the user has directly chosen to view them (see items 4 and 7 below), and does not place advertisements on other screens or perform profiling for that purpose. Additionally, we use measurement tools from advertising platforms to measure the performance of Pogl Play advertisements placed on other services and to optimize the audience for displaying advertisements (see items 4 and 7 below).

3. AI Training and Service Improvement

Pogl Play may use the following data for AI model learning, evaluation, and improvement for service quality improvement and AI model development. The AI models created thereby and datasets processed so that individuals cannot be identified may be used within and outside Pogl Play services or provided and sold to third parties, and no separate consent is required for this. Personal information itself that can identify individuals is not sold.

• Inputs and results of the experience creation process: prompts, design docs, selections, generated code, assets, and text, and version history
• Play data: game play screen recording, operation input, progress and results, session length, completion status, boot success status, reactions such as likes and reports
• Error and quality information to determine whether the service is operating normally

• Before using for training, we remove or pseudonymize account identifiers. Pseudonymized information may still be personal information, and statutory rights such as deletion continue to apply.
• We do not use account email addresses, passwords, or payment information themselves as training data. Please ensure that such information is not included in the input materials. If we confirm that such information is included, we will apply necessary measures such as deletion or exclusion.
• Learned models are not designed to reproduce specific user content verbatim. De-identified and aggregated information that meets legal standards may continue to be used for statistics and improvement, and re-identification is not performed except for verification permitted by law. When providing or selling de-identified datasets to third parties, identifiable information such as names visible on screen is obscured or removed, and the recipient is contractually prohibited from attempting re-identification.

Inquiries and requests regarding the use of learning data are received at the contact below. The exercise of rights under Section 6 and applicable laws apply to learning data that constitutes personal information. Providing materials to AI service providers is for the performance of tasks such as experience generation and verification, and does not constitute permission for the provider's independent general-purpose model learning.

4. Sale, Sharing, and Business Provision of Personal Information

Pogl Play does not sell personal information. However, it places measurement tools (pixels) from advertising platforms on the service interface to measure the performance of Pogl Play advertisements displayed in other services and to optimize the audience for showing ads, which may constitute "sharing" for cross-context behavioral advertising under the CCPA. The information sent to the advertising platform includes the address of the visited page (including the advertisement click identifier and campaign tail tag), the fact that registration occurred and the method of registration, the fact that experience creation was started and the fact that the game was used for more than 10 seconds, IP address, browser and device information, and the advertising platform's cookie identifier. Email addresses, @handles, account identifiers, game play screens, and control records are not transmitted, and measurement events are not sent from addresses containing private room invitation keys or login codes. The advertising platform processes this information according to its own policies. We are not aware of selling or sharing the personal information of users under the age of 16. Providing or selling AI models and de-identified datasets under Article 3 does not constitute the sale of personal information.

Pogl Play does not use or disclose account login information beyond the scope necessary for service provision, account protection, and security incident response. Therefore, there is currently no separate use that would require a request to limit the use of sensitive personal information.

For service operation, we entrust the following tasks to service providers or contractors. We prohibit those entities from using the information beyond the contractual purposes and require appropriate safeguards. The information below has been provided within the scope necessary for each task in the past 12 months.

We may provide information to relevant authorities, legal advisors, etc., to the extent necessary for compliance with legal obligations, lawful investigations and court proceedings, prevention of fraud and security incidents, protection of the rights and safety of users and the service, and the exercise or defense of legal claims. If we have a notice obligation, we will comply with it, and may delay or omit notice to the extent permitted by law for the purposes of investigation, security, or protection of third-party rights.

Public profiles, experiences, comments, rankings, etc. may be visible to other users depending on the public scope selected by the user and the service features. Please check before publishing materials containing personal information. In mergers, acquisitions, business transfers, or related due diligence, necessary information may be provided to potential acquirers, successors, or advisors under confidentiality and protection obligations. In such cases, we follow the guidance and consent required by applicable law and existing personal information protection obligations.

The browser’s Global Privacy Control (GPC) signal is recognized as a request to opt out of the sale or sharing of personal information, and the advertising platform’s measurement tool is not loaded in browsers with the signal enabled. Measurement and personalized advertising can also be restricted through browser tracking prevention and ad-blocking features or each advertising platform’s ad settings. No separate action changes are applied to generic Do Not Track signals. Analytics and error processing providers may process service usage information and diagnostic information on behalf of Pogl Play and may not use it for their own personalized advertising purposes.

When you download the Pogl Play app from the store, instead of pixels, the app uses the advertising platform's app measurement tool (SDK) for the same purpose. The fact that you installed or opened the app, the fact that registration occurred and the method of registration, the fact that you started an experience design and used the experience for more than 10 seconds, IP address, device and app information, and the device's advertising identifier may be transmitted. On devices where the operating system asks about tracking permission, the advertising identifier is transmitted only if you allow it, and you can limit measurement by resetting or deleting the advertising identifier in device settings. Email address, @handle, and account identifier are not transmitted. Depending on the advertising platform's settings, the fact that a payment occurred within the app, along with the product and amount, may be transmitted. In addition, when you first open the app, it may read the installation path (campaign tag) provided by the store to identify which ad or post you used to install the app.

When users download the Pogl Play app from the Store and choose to view ads or participate in interactive ads (missions), the device advertising identifier, IP address, device and app information, the fact that they viewed the ad or completed the mission, and the account identifier necessary for reward payment are provided to Google, which provides the ads, and the interactive ad provider. These companies use the received information for ad delivery, reward payment, and prevention of misuse, and may use it for personalized ads based on device settings and consent. Information directly entered into an advertiser's service while performing a mission is processed according to that advertiser's policy. Users can reset or delete the advertising identifier in device settings to limit personalized ads.

5. Retention Period and Deletion

• When you delete an account, the authenticated account is removed, and the profile, handle, saved data, sessions, follows, likes, comments, inventory, and wallet that reference that account are deleted together.
• Public experiences may be being played by other users, so we first switch them to private and then delete them.
• Coin, purchase, and settlement records are retained for the period prescribed by relevant laws for accounting, tax, and dispute response purposes.
• Report and sanction records are retained only for the period necessary to prevent recurrence and respond to disputes, considering the severity of the issue, risk of repetition, objection or litigation period, and legal preservation obligations.
• @handles are reserved for 90 days after account deletion to prevent impersonation.
• Analytics and error logs follow the retention policy of each processing system, and upon account deletion, we request deletion of the corresponding identifiers.
• Valid deletion requests also apply to personal information used for training and exclude it from future training. Whether the impact of specific data can be separated from already generated models is determined based on technology and applicable law, and the mere fact that it is a model does not exclude statutory deletion or correction obligations. De-identified or aggregated results that meet legal standards and are not personal information may be retained.
• Retention exceptions are limited to the extent necessary for permitted purposes such as legal obligations, security, and dispute response. Backups are deleted according to the normal replacement cycle if immediate individual deletion is difficult, and valid deletion requests are re-applied upon restoration. When the need for retention ends, we delete or de-identify the data in accordance with legal standards.

Account deletion can be requested from the web and app at Settings › Danger Zone › Account Deletion. If you request deletion and 30 days pass, your account and personal information will be deleted; you can cancel the request by logging in again before that happens. If you cannot log in or have deleted the app, please submit it through the support page as a personal information/account deletion type. Once deletion is processed, your @handle will be reclaimed, and payment and safety-related records will be retained for the above retention period.

6. User Rights

Users may request access, correction, deletion, processing suspension, and withdrawal of consent to their personal information within the scope prescribed by applicable law. Data processing necessary for experience creation, execution, and verification is distinguished from training for AI model improvement. Service use is not restricted solely on the basis of exercising privacy-related rights or refusing consent for training for which separate consent is required by law. If data processing strictly necessary for the requested feature is impossible, providing that feature may be difficult, and the scope and reasons are communicated. Requests that cannot be processed are communicated with the reasons and available appeal methods to the extent permitted by law.

• In the app directly: change @handle, make my experiences private or delete them, delete my comments, change language settings, change the visibility of my playing status, manage blocks, configure notification reception
• Handled via inquiry: full account deletion, request a copy of stored data, request deletion of analytics and error logs, requests regarding use for AI training

California residents have the following rights to the extent that the CCPA applies: the right to know the categories and specific pieces of personal information collected, the sources of the information, the purposes of use, and the categories of third parties to whom it was provided; the right to request deletion and correction of personal information; the right to opt out of the sale or sharing of personal information; the right to limit the use or disclosure of sensitive personal information; the right to receive a copy of personal information in a portable format.

Pogl Play does not sell personal information. The sharing for advertising performance measurement (4) can be opted out via the GPC signal, and the advertising platform’s measurement tool is not loaded in browsers with the signal enabled. The service is not restricted or disadvantaged because a user exercises their rights regarding personal information.

Requests for personal information rights can be submitted on the support page under the type of personal information/account deletion. After logging in, please write the desired action and scope of the request. Submitted content and responses can be checked in My Inquiries. For requests for access, deletion, and correction under the CCPA, we will acknowledge receipt within 10 business days and generally process them within 45 days from the date of receipt. If necessary, we may notify the reason within the initial period and extend by an additional 45 days once. For requests subject to shorter statutory deadlines, such as opt-out of sale/sharing or restriction of use of sensitive personal information, we will follow those deadlines.

Before processing your request, we may verify your identity through account login, confirmation of your registered email, or comparison with information we already hold. Information received for verification will be used only for identity verification. An authorized agent must submit a power of attorney signed by you, and Pogl Play may directly confirm the authorization with you. A legal guardian may exercise rights on behalf of a minor.

7. Cookies and Browser Storage

• Login session tokens are stored in the browser's local storage. Deleting this information will log you out.
• Language settings (pogl_locale) are stored in a cookie and used to determine the display language on the first screen.
• Device identifiers are stored in the browser's local storage and first-party cookies and are used to distinguish analytics events from service screen usage records. When a member logs in, the analytics records for that device are linked to the account identifier; when logging out, a new device identifier is used.
• Onboarding and sound settings are stored in session storage and are deleted when the browser tab is closed.
• The advertising platform’s measurement tool stores ad click identifiers and visitor identifiers in first-party cookies and may use cookies on the advertising platform’s domain. It is not loaded in browsers with the GPC signal enabled.

Pogl Play may display Google ads on the service screen and uses a method where users can view ads and receive rewards (such as free coins) within the service only if they choose to do so directly. When ads are displayed, third-party ad companies including Google use cookies to provide ads based on users' visit records to this service and other websites. Google uses advertising cookies to allow Google and its partners to display ads to users based on their visit records to this service and other sites on the internet. Users can set their Google Ads preferences (https://adssettings.google.com) to opt out of personalized ads, and can set other third-party companies to not use cookies for personalized ads at www.aboutads.info. Users in the European Economic Area, the United Kingdom, and Switzerland are asked for consent before advertising cookies are used.

Pogl Play does not use cookies for advertising or tracking purposes other than the above ad performance measurement and ad delivery. Deleting browser storage may also delete progress information for anonymous users.

8. Security Measures

• Access permissions are restricted on a row-by-row basis to protect against viewing other users' stored data, wallets, and report contents.
• Server-only authentication credentials are managed only on the server, and only public keys are provided to the browser.
• Score, coin, and item related information is verified and processed on the server.
• We apply encryption of the transmission section via HTTPS, blocking of dangerous APIs in experience code, and restriction of external URL access.
• Only approved accounts can access the admin screen.

9. Children Under 13

The Service is not directed to children under 13 and does not knowingly collect personal information from such children (COPPA). If an account is identified as belonging to a child under 13, we will delete the account and data. If a guardian confirms that their child has provided personal information, please contact us at the contact information below. After verification, we will inform you of the deletion result.

10. International Transfer of Personal Information

Personal data is stored and processed on servers located in countries including the United States, the United Kingdom, Singapore, and Japan. The items transferred and the purposes are the same as in Section 4, and transfers occur at the time each feature is used, such as generation requests, screen events, and error occurrences. The location of servers or the choice of Delaware law in these Terms does not alone exclude mandatory personal data protection laws applicable to users. Processing is carried out with the legal basis for transfer, protective measures, notice, and consent required by applicable laws.

11. Contact

The entity that processes personal information is Celon Inc. Inquiries, requests, and objection applications related to personal information processing can be submitted to the contact below. Received requests will be processed without delay and the results will be notified.

12. Changes to This Policy

If we change this Policy, we will notify you through the Service 7 days before the effective date. For material changes such as the addition of collected items or expansion of purposes of use, we will notify you of the changes and effective date 30 days in advance and obtain necessary consent. If a shorter period is unavoidable due to legal compliance or urgent security response, we will notify you as promptly as possible. When using previously collected information for a new purpose incompatible with the prior notice, we will provide prior notice and obtain necessary consent in accordance with applicable laws.