한국어

Minicar Champion Road Privacy Policy

• Operator: Aurel Studio
• Version 1.3 · Effective October 19, 2026 (announced October 12, 2026)
• This version applies from October 19, 2026. Until then, the current version (1.2) applies.

This is an English translation. If it differs from the Korean version, the Korean version prevails.

Aurel Studio ("the Studio") runs the online racing RPG "Minicar Champion Road" and its official website ("the Service") and processes users' personal information as follows under the Personal Information Protection Act of the Republic of Korea.

The offline beta played without the internet (app 1.5–1.6) does not collect personal information and is covered by the separate privacy policy for the offline version. This policy applies to the online version you log in to with an account (app 2.0 and later) and to the official website.

1. Personal information we process, purposes, legal bases and retention

• Legal bases: Contract = performing the service agreement (Article 15(1)4 of the Personal Information Protection Act), legitimate interest = item 6 of the same paragraph, law = item 2 of the same paragraph (Protection of Communications Secrets Act — access logs), consent = item 1 of the same paragraph and Article 50 of the Act on Promotion of Information and Communications Network Utilization and Information Protection ("Network Act") (marketing emails — optional). Apart from "Marketing emails", all of the above can be processed without consent, and we state the bases separately under Article 22(3) of the same Act. If we need to process personal information for any other purpose, we will ask for separate consent first.
• The required "consent to collection and use of personal information" box at sign-up is how you are informed of and confirm the contract, legitimate-interest and legal items above (those items can be processed without consent). The only consent you can choose is the optional "Marketing emails" (「(선택) 광고성 정보 수신」), asked separately from the required items.
• Marketing emails (optional consent): when you sign up (on the game's sign-up screen or the official website), you can choose "(Optional) Marketing emails" separately from the required items; it is not chosen by default. The purpose is sending Minicar Champion Road advertising information such as events, benefits and news; the item is your email address; we keep it for this purpose until you withdraw consent or delete your account. You have the right to refuse, and refusing or later withdrawing has no effect at all on your use of the game or the website. After signing up you can consent or withdraw at any time in the in-game "Account" window or under "My info" on the official website.
• We send advertising information by email only. We do not send marketing text messages (SMS) or push notifications, and we do not ask for a phone number for this.
• Whenever you consent or withdraw (at sign-up, in the game or on the website, through an unsubscribe link, or by asking us), we immediately email the result (the sender, the date and what was done) to your registered address and also show it on screen. Every 2 years from the date of your consent (or of the last confirmation notice) we send a notice confirming your consent, with its date and how to keep or withdraw it.
• Marketing emails go only to users who have consented. They have "(광고)" ("Advertisement") at the start of the subject and end with the sender's name, contact details and how to unsubscribe. The unsubscribe link at the end of each email (or your mail app's "Unsubscribe" button) unsubscribes you immediately and free of charge without logging in, and if you ask by email (thirtyshots2689@outlook.com) the operator turns it off for you. Result notices, confirmation notices and marketing emails are sent through the email delivery provider Resend (sections 4 and 5).
• Security logs are linked to the account number. We do not log login attempts with email addresses that have no account.
• You can turn auto-login on or off per device (off by default on PC). Turning on two-step verification signs out auto-login on devices other than the current one.
• Other users can see your racer name and board posts. Your email address is not shown to other users.
• "Send feedback" in the game only opens your mail app to write an email; the app sends nothing by itself. The message is prefilled only with the app version, device model, OS version and game progress, and you can edit it before sending.
• We do not process payment information, sensitive information or pseudonymized information, and we do not collect location information. We use no analytics tools (SDKs). Our only advertising tool is the rewarded ad in the game app (Google AdMob — Android app 2.1 and later, iPhone app 2.4.0 and later): it talks to Google only from the moment you tap "Watch an ad" in the shop until you close the app (section 5, transfer abroad · section 10, behavioral information). There are no banner or interstitial ads, and PC has no ads. The iPhone app does no tracking (linking with data collected from other companies' apps or websites), so it does not ask for tracking permission (App Tracking Transparency) and does not use the advertising identifier (IDFA).

2. Destruction procedures and methods

• Personal information whose retention period has ended or whose purpose has been achieved is destroyed without delay (within 5 days at the latest).
• When you delete your account, the account, racer name, cloud save and save history, two-step verification data, marketing consent and its records, and board posts/comments are deleted from the live database at once, and that account's progress on the device is also deleted. The account deletion record (account number and time of deletion — to confirm deletion and handle disputes) and report/sanction records are kept for 1 year, and email inquiries for 1 year after handling, then deleted. Details are in "Account Deletion".
• When you withdraw marketing consent, we stop using your email address for marketing from that moment. The email address stays as long as the account exists because the account needs it, and the consent and withdrawal records are kept until the account is deleted (lines in the server security log 1 year) as proof of consent and withdrawal.
• Daily database backups are deleted automatically after 14 days, and server snapshots, if used, after 7 days. Backups are used only for disaster recovery; even if the server is restored from a backup, deleted accounts are deleted again.
• Under the Protection of Communications Secrets Act, access logs (IP address, access time) are kept for 3 months.
• Electronic files are deleted so they cannot be recovered. We do not keep personal information on paper.

3. Provision to third parties

The Studio does not provide personal information to third parties, except where the law specifically requires it, such as a request by an investigative agency under legal procedures.

If you choose to watch an ad in the Android or iPhone app, the Google ad SDK (AdMob) in the app sends device and app information and ad records (and on Android, your advertising ID) directly to Google LLC. The Studio does not give Google the account information it holds (email, racer name, game progress and so on) (sections 5 and 10).

4. Outsourcing of processing

"When enabled" means the processing is outsourced from the time that sending feature is turned on. Until then the feature cannot be used, and the screen says so.

5. Transfer abroad

Personal information for the game server, database and official website is stored in the Republic of Korea (AWS Seoul region, ap-northeast-2), and information of users who connect from abroad is also processed in Korea. It is transferred abroad only in the following cases.

• If you do not want the transfer: you can turn on two-step verification by text message instead of email, or not use two-step verification (password reset works only by email — you can link a Google account instead); and you can leave personal information out of inquiry emails or use the in-game account features (such as account deletion). Ad information is not sent unless you tap "Watch an ad" (during the beta, Premium Packs can only be opened with ads). If you do not consent to marketing emails, no notices or marketing emails are transferred (when you withdraw, the one result notice is). Not receiving marketing emails changes nothing else.

6. Rights and duties of data subjects and legal representatives

• You may at any time request access to, correction or deletion of, or suspension of processing of your personal information, and withdraw consent. You can withdraw marketing consent at any time in the in-game "Account" window, under "My info" on the official website, with the unsubscribe link at the end of any marketing email (no login, free), or by email (thirtyshots2689@outlook.com — the operator turns it off) (section 1).
• You can check and delete it yourself in the game's "Account" window or the official website's "My info", or ask the Studio from your registered email. A legal representative or an authorized person may also ask, with a power of attorney.
• The Studio informs you of the result within 10 days of the request. If it refuses or limits the request under the law, such as for information other laws require us to keep (e.g., access logs), it tells you why and how to object.
• You must protect your own password and must not infringe other people's personal information.

7. Automated measures

The Studio does not make fully automated decisions that significantly affect users' rights or duties. However, to keep the board orderly, some profanity is masked automatically, and posts or comments reported by 3 different users are hidden automatically until an operator reviews them. Logging in is also blocked for a short time after many wrong passwords in a short time. If you ask for an explanation or object by email, a person reviews it again.

8. Children under 14

Children under 14 cannot sign up, and we confirm that users are 14 or older at sign-up. If we learn that we have collected information from a child under 14, we delete the account and information at once. A legal representative can request deletion by email.

9. Security measures

• Passwords are stored only as salted hashes and are not kept on the device. Mobile numbers are encrypted, and backup codes and verification codes are stored only as irreversible values.
• All communication is encrypted with TLS (HTTPS, WSS).
• Server administration uses SSH keys only, the admin console is not exposed to the outside, and the firewall allows only the needed connections (web 80/443, admin 22).
• Security updates are applied to the server automatically, and request rate limits and login attempt limits prevent abuse. Irreversible actions such as account deletion happen only after checking the password (or Google account) again.
• The unsubscribe link in marketing emails carries a check value made with a server key that fits only that member, so it cannot change anyone else's settings, and the value is not kept in access logs. The key for the email delivery provider is kept only in the server settings.
• Access to personal information is limited to the operator.
• Backups are made daily and deleted automatically after the set period. The servers are under the physical security of AWS data centers.

10. Automatic collection tools and how to refuse them; behavioral information

• The official website keeps your login in the browser's session storage to keep you logged in. It is cleared when you close the browser tab. Your language choice is kept in the browser's local storage.
• The official website uses no advertising or analytics cookies or behavioral tracking tools.
• The game app stores a device identifier and the auto-login setting on the device for auto-login.
• How to refuse: you can block site data storage in your browser settings, but website login may then not work. In the game, turning off auto-login or logging out unlinks the device.
• Behavioral information (Android app 2.1 and later · iPhone app 2.4.0 and later): when you tap "Watch an ad" in the shop, the app shows a rewarded ad through the Google ad SDK (AdMob). Behavioral information is then collected as follows.
  • What is collected: ad request, view and click records, the app and time the ad was shown, and on Android also the advertising ID (the iPhone app does not ask for tracking permission and does not use the IDFA)
  • How: the SDK in the app collects it automatically and sends it to Google when an ad loads or plays
  • Why: showing ads (including personalized ads), confirming rewards, measuring ad performance, preventing abuse
  • Who collects and processes it: Google LLC (USA) · how long: as set out in Google's Privacy Policy
  • Your choices: if you never tap "Watch an ad", the ad SDK does not talk to Google. In your phone's Settings → Google → Ads you can delete or reset your advertising ID (once deleted it is not used for personalized ads), and you can turn off personalized ads in Google's ad settings (adssettings.google.com). On iPhone, Settings → Privacy & Security → Tracking lets you stop apps from asking to track, and Apple Advertising in the same menu turns off Apple's personalized ads (this app does not ask to track). Google's ad settings work the same on iPhone.
  • Ad requests are marked as not directed at children, with the maximum ad content rating set to Teen (T). Children under 14 cannot sign up.

11. Privacy officer

• Contact: Aurel Studio Privacy Officer
• Email: thirtyshots2689@outlook.com

Please use this contact for privacy questions, access requests, complaints and remedies.

12. Remedies for infringement

For advice or dispute mediation about privacy infringement, you can contact the following Korean agencies.

• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Center: 118, privacy.kisa.or.kr
• Supreme Prosecutors' Office: 1301, www.spo.go.kr
• Korean National Police Agency: 182, ecrm.police.go.kr

13. Changes to this policy

When this policy changes, we announce it in an in-game notice and on the official website 7 days before it takes effect (30 days for important changes).

• Version 1.3: effective October 19, 2026 (announced October 12) — added rewarded ads in the iPhone app (2.4.0 and later, Google AdMob): collected items (no IDFA on iPhone — no tracking permission is requested), transfer abroad (Google — including iPhone), behavioral information and how to turn off ad personalization on iPhone (sections 1, 3, 5 and 10)
• Version 1.2: effective October 18, 2026 (announced October 11) — added the optional consent "Marketing emails" (email only): purpose, items and retention, the right to refuse without any disadvantage, notification of consent and withdrawal results and confirmation every 2 years, how to withdraw (in-game Account window, website My info, unsubscribe link in emails, email inquiry), how marketing emails are labeled, deletion with the account, marketing-related emails added to the scope of the email delivery (Resend) outsourcing and transfer abroad, and that the privacy box at sign-up is a confirmation (sections 1, 2, 4, 5, 6 and 9)
• Version 1.1: effective October 16, 2026 — added rewarded ads in the Android app (Google AdMob) (sections 1, 3, 5 and 10). Corrected on October 9: the email processor's name (Plus Five Five, Inc. — service name Resend) and the recipients' contacts in section 5
• Version 1.0: effective October 5, 2026