한국어日本語

Minicar Champion Road Privacy Policy

• Operator: HK (에이치케이) · game brand Aurel Studio
• Version 1.4 · Effective October 25, 2026 (announced October 18, 2026)
• This version applies from October 25, 2026. Until then, the current version applies.

This is an English translation. If it differs from the Korean version, the Korean version prevails.

HK (에이치케이; game brand Aurel Studio, "the Studio") runs the online racing RPG "Minicar Champion Road" and its official website ("the Service") and processes users' personal information as follows under the Personal Information Protection Act of the Republic of Korea. If you live outside the Republic of Korea, section 14 also applies under the laws of your country or region (such as the GDPR in the EU and UK, the CCPA and CPRA in California, and Japan's Act on the Protection of Personal Information).

The offline beta played without the internet (app 1.5–1.6) does not collect personal information and is covered by the separate privacy policy for the offline version. This policy applies to the online version you log in to with an account (app 2.0 and later) and to the official website.

1. Personal information we process, purposes, legal bases and retention

• Legal bases: Contract = performing the service agreement (Article 15(1)4 of the Personal Information Protection Act), legitimate interest = item 6 of the same paragraph, law = item 2 of the same paragraph (Protection of Communications Secrets Act — access logs), consent = item 1 of the same paragraph and Article 50 of the Act on Promotion of Information and Communications Network Utilization and Information Protection ("Network Act") (marketing emails — optional). Apart from "Marketing emails", all of the above can be processed without consent, and we state the bases separately under Article 22(3) of the same Act. If we need to process personal information for any other purpose, we will ask for separate consent first.
• The required "consent to collection and use of personal information" box at sign-up is how you are informed of and confirm the contract, legitimate-interest and legal items above (those items can be processed without consent). The only consent you can choose is the optional "Marketing emails" (「(선택) 광고성 정보 수신」), asked separately from the required items.
• Marketing emails (optional consent): when you sign up (on the game's sign-up screen or the official website), you can choose "(Optional) Marketing emails" separately from the required items; it is not chosen by default. The purpose is sending Minicar Champion Road advertising information such as events, benefits and news; the item is your email address; we keep it for this purpose until you withdraw consent or delete your account. You have the right to refuse, and refusing or later withdrawing has no effect at all on your use of the game or the website. After signing up you can consent or withdraw at any time in the in-game "Account" window or under "My info" on the official website.
• We send advertising information by email only. We do not send marketing text messages (SMS) or push notifications, and we do not ask for a phone number for this.
• Whenever you consent or withdraw (at sign-up, in the game or on the website, through an unsubscribe link, or by asking us), we immediately email the result (the sender, the date and what was done) to your registered address and also show it on screen. Every 2 years from the date of your consent (or of the last confirmation notice) we send a notice confirming your consent, with its date and how to keep or withdraw it.
• Marketing emails go only to users who have consented. They have "(광고)" ("Advertisement") at the start of the subject and end with the sender's name, contact details and how to unsubscribe. The unsubscribe link at the end of each email (or your mail app's "Unsubscribe" button) unsubscribes you immediately and free of charge without logging in, and if you ask by email (thirtyshots2689@outlook.com) the operator turns it off for you. Result notices, confirmation notices and marketing emails are sent through the email delivery provider Resend (sections 4 and 5).
• Security logs are linked to the account number. We do not log login attempts with email addresses that have no account.
• You can turn auto-login on or off per device (off by default on PC). Turning on two-step verification signs out auto-login on devices other than the current one.
• Play as Guest (guest): if you play without an account, game progress is saved only on this device and is not sent to the Studio's servers, and the Studio processes no personal information about guest users. However, once you tap "Watch an ad" in the shop, processing is as in the rewarded ads row above (collected directly by Google). If you later create an account and choose "Upload this device's progress", it is processed as in the cloud save row from then on; if you do not, this device's progress is kept separately on the device.
• Ad consent (EEA, UK and similar regions): in these regions, the first time you tap "Watch an ad", Google's consent management tool (UMP) asks for your consent to personalized ads and to using device storage for ads. Your choice is stored on the device and passed to Google with ad requests, and you can change or withdraw it at any time in the game under Settings → Ad privacy settings. If you do not consent, Google shows non-personalized or limited ads, or possibly no ad (section 14).
• Other users can see your racer name and board posts. Your email address is not shown to other users.
• "Send feedback" in the game only opens your mail app to write an email; the app sends nothing by itself. The message is prefilled only with the app version, device model, OS version and game progress, and you can edit it before sending.
• We do not process payment card details (payments for paid products are handled by Google Play and the App Store), sensitive information or pseudonymized information, and we do not collect location information. We use no analytics tools (SDKs). Our only advertising tool is the rewarded ad in the game app (Google AdMob — Android app 2.1 and later, iPhone app 2.4.0 and later): it talks to Google only from the moment you tap "Watch an ad" in the shop until you close the app (section 5, transfer abroad · section 10, behavioral information). There are no banner or interstitial ads, and PC has no ads. The iPhone app does no tracking (linking with data collected from other companies' apps or websites), so it does not ask for tracking permission (App Tracking Transparency) and does not use the advertising identifier (IDFA).

2. Destruction procedures and methods

• Personal information whose retention period has ended or whose purpose has been achieved is destroyed without delay (within 5 days at the latest).
• When you delete your account, the account, racer name, cloud save and save history, two-step verification data, marketing consent and its records, and board posts/comments are deleted from the live database at once, and that account's progress on the device is also deleted. The account deletion record (account number and time of deletion — to confirm deletion and handle disputes) and report/sanction records are kept for 1 year, and email inquiries for 1 year after handling, then deleted. Details are in "Account Deletion".
• Paid product purchase records are kept separately for 5 years even after account deletion, as required by the Act on Consumer Protection in Electronic Commerce, and are used only to confirm transactions and handle disputes before being deleted.
• When you withdraw marketing consent, we stop using your email address for marketing from that moment. The email address stays as long as the account exists because the account needs it, and the consent and withdrawal records are kept until the account is deleted (lines in the server security log 1 year) as proof of consent and withdrawal.
• Daily database backups are deleted automatically after 14 days, and server snapshots, if used, after 7 days. Backups are used only for disaster recovery; even if the server is restored from a backup, deleted accounts are deleted again.
• Under the Protection of Communications Secrets Act, access logs (IP address, access time) are kept for 3 months.
• Electronic files are deleted so they cannot be recovered. We do not keep personal information on paper.

3. Provision to third parties

The Studio does not provide personal information to third parties, except where the law specifically requires it, such as a request by an investigative agency under legal procedures.

If you choose to watch an ad in the Android or iPhone app, the Google ad SDK (AdMob) in the app sends device and app information and ad records (and on Android, your advertising ID) directly to Google LLC. The Studio does not give Google the account information it holds (email, racer name, game progress and so on) (sections 5 and 10).

4. Outsourcing of processing

"When enabled" means the processing is outsourced from the time that sending feature is turned on. Until then the feature cannot be used, and the screen says so.

5. Transfer abroad

Personal information for the game server, database and official website is stored in the Republic of Korea (AWS Seoul region, ap-northeast-2), and information of users who connect from abroad is also processed in Korea (for users outside Korea this is a transfer to Korea — section 14). It is transferred abroad only in the following cases.

• If you do not want the transfer: you can turn on two-step verification by text message instead of email, or not use two-step verification (password reset works only by email — you can link a Google account instead); and you can leave personal information out of inquiry emails or use the in-game account features (such as account deletion). Ad information is not sent unless you tap "Watch an ad" (during the beta, Premium Packs can only be opened with ads). If you do not consent to marketing emails, no notices or marketing emails are transferred (when you withdraw, the one result notice is). Not receiving marketing emails changes nothing else.

6. Rights and duties of data subjects and legal representatives

• You may at any time request access to, correction or deletion of, or suspension of processing of your personal information, and withdraw consent. You can withdraw marketing consent at any time in the in-game "Account" window, under "My info" on the official website, with the unsubscribe link at the end of any marketing email (no login, free), or by email (thirtyshots2689@outlook.com — the operator turns it off) (section 1).
• You can check and delete it yourself in the game's "Account" window or the official website's "My info", or ask the Studio from your registered email. A legal representative or an authorized person may also ask, with a power of attorney.
• The Studio informs you of the result within 10 days of the request (additional rights and response times for users outside Korea are in section 14). If it refuses or limits the request under the law, such as for information other laws require us to keep (e.g., access logs), it tells you why and how to object.
• You must protect your own password and must not infringe other people's personal information.

7. Automated measures

The Studio does not make fully automated decisions that significantly affect users' rights or duties. However, to keep the board orderly, some profanity is masked automatically, and posts or comments reported by 3 different users are hidden automatically until an operator reviews them. Logging in is also blocked for a short time after many wrong passwords in a short time. If you ask for an explanation or object by email, a person reviews it again.

8. Children and sign-up age

• Users in the Republic of Korea must be 14 or older, and users in all other countries and regions 16 or older, to create an account. If the law of your country sets a higher age at which you can consent to the processing of your personal information yourself, you can sign up from that age. At sign-up we confirm the age that matches the region (country) setting of your device.
• "Play as Guest" (guest) is open to everyone regardless of age. In that case the Studio processes no personal information (section 1). Ad request settings are as in section 10.
• If we learn that we have collected information from someone below the sign-up age, we delete the account and information at once. A legal representative (parent or guardian) can request deletion by email.

9. Security measures

• Passwords are stored only as salted hashes and are not kept on the device. Mobile numbers are encrypted, and backup codes and verification codes are stored only as irreversible values.
• All communication is encrypted with TLS (HTTPS, WSS).
• Server administration uses SSH keys only, the admin console is not exposed to the outside, and the firewall allows only the needed connections (web 80/443, admin 22).
• Security updates are applied to the server automatically, and request rate limits and login attempt limits prevent abuse. Irreversible actions such as account deletion happen only after checking the password (or Google account) again.
• The unsubscribe link in marketing emails carries a check value made with a server key that fits only that member, so it cannot change anyone else's settings, and the value is not kept in access logs. The key for the email delivery provider is kept only in the server settings.
• Access to personal information is limited to the operator.
• Backups are made daily and deleted automatically after the set period. The servers are under the physical security of AWS data centers.

10. Automatic collection tools and how to refuse them; behavioral information

• The official website keeps your login in the browser's session storage to keep you logged in. It is cleared when you close the browser tab. Your language choice is kept in the browser's local storage.
• The official website uses no advertising or analytics cookies or behavioral tracking tools.
• The game app stores a device identifier and the auto-login setting on the device for auto-login.
• How to refuse: you can block site data storage in your browser settings, but website login may then not work. In the game, turning off auto-login or logging out unlinks the device.
• Behavioral information (Android app 2.1 and later · iPhone app 2.4.0 and later): when you tap "Watch an ad" in the shop, the app shows a rewarded ad through the Google ad SDK (AdMob). Behavioral information is then collected as follows.
  • What is collected: ad request, view and click records, the app and time the ad was shown, and on Android also the advertising ID (the iPhone app does not ask for tracking permission and does not use the IDFA)
  • How: the SDK in the app collects it automatically and sends it to Google when an ad loads or plays
  • Why: showing ads (including personalized ads), confirming rewards, measuring ad performance, preventing abuse
  • Who collects and processes it: Google LLC (USA) · how long: as set out in Google's Privacy Policy
  • Your choices: if you never tap "Watch an ad", the ad SDK does not talk to Google. In your phone's Settings → Google → Ads you can delete or reset your advertising ID (once deleted it is not used for personalized ads), and you can turn off personalized ads in Google's ad settings (adssettings.google.com). On iPhone, Settings → Privacy & Security → Tracking lets you stop apps from asking to track, and Apple Advertising in the same menu turns off Apple's personalized ads (this app does not ask to track). Google's ad settings work the same on iPhone. In the EEA, the UK and similar regions, you can reopen Google's consent form (UMP) in the game under Settings → Ad privacy settings to change or withdraw consent to personalized ads.
  • Ad requests are marked as not directed at children, with the maximum ad content rating set to Teen (T). The sign-up age is as in section 8.

11. Privacy officer

• Privacy officer: Yu Jae-young (유재영), Representative
• Phone: +82-10-2906-5202
• Email: thirtyshots2689@outlook.com

Please use this contact for privacy questions, access requests, complaints and remedies.

12. Remedies for infringement

For advice or dispute mediation about privacy infringement, you can contact the following Korean agencies.

• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
• Personal Information Infringement Report Center: 118, privacy.kisa.or.kr
• Supreme Prosecutors' Office: 1301, www.spo.go.kr
• Korean National Police Agency: 182, ecrm.police.go.kr

13. Changes to this policy

When this policy changes, we announce it in an in-game notice and on the official website 7 days before it takes effect (30 days for important changes). This policy is written in Korean; if a translation (English or Japanese) differs, the Korean version prevails.

• Version 1.4: effective October 25, 2026 (announced October 18) — additional information by country and region for the worldwide launch of the English and Japanese versions (section 14: legal bases, rights and international transfer safeguards under the GDPR and UK GDPR, CCPA/CPRA disclosures for California and no sale or sharing, provision to third parties in foreign countries under Japan's Act), sign-up age by country and guest play (sections 1 and 8), ad consent (UMP) and how to withdraw it (sections 1 and 10), paid product purchase records and purchase verification (sections 1, 2 and 5), operator details and privacy officer (sections 11 and 14), Japanese translation
• Version 1.3: effective October 19, 2026 (announced October 12) — added rewarded ads in the iPhone app (2.4.0 and later, Google AdMob): collected items (no IDFA on iPhone — no tracking permission is requested), transfer abroad (Google — including iPhone), behavioral information and how to turn off ad personalization on iPhone (sections 1, 3, 5 and 10)
• Version 1.2: effective October 18, 2026 (announced October 11) — added the optional consent "Marketing emails" (email only): purpose, items and retention, the right to refuse without any disadvantage, notification of consent and withdrawal results and confirmation every 2 years, how to withdraw (in-game Account window, website My info, unsubscribe link in emails, email inquiry), how marketing emails are labeled, deletion with the account, marketing-related emails added to the scope of the email delivery (Resend) outsourcing and transfer abroad, and that the privacy box at sign-up is a confirmation (sections 1, 2, 4, 5, 6 and 9)
• Version 1.1: effective October 16, 2026 — added rewarded ads in the Android app (Google AdMob) (sections 1, 3, 5 and 10). Corrected on October 9: the email processor's name (Plus Five Five, Inc. — service name Resend) and the recipients' contacts in section 5
• Version 1.0: effective October 5, 2026

14. Additional information by country and region

If you live outside the Republic of Korea, the information below for where you live applies in addition to sections 1–13. Where it differs from sections 1–13, whichever is more favorable to you applies.

14-1. General

• Controller: HK (에이치케이; game brand Aurel Studio · 1116, 53 Oncheon-ro, Yuseong-gu, Daejeon, Republic of Korea · Representative Yu Jae-young) · contact thirtyshots2689@outlook.com (section 11). All privacy questions and the requests below go to this address.
• Account and game information of all users is processed in the Republic of Korea (AWS Seoul region). Everyone else who receives information is listed in section 4 (outsourcing) and section 5 (transfer abroad).
• Retention periods for each item are as in sections 1 and 2.
• To create an account you must give an email address and password (or a Google account); without them an account cannot be created. You can still play without an account using "Play as Guest" (section 1).
• To confirm your identity when you exercise your rights, we may ask you to reply from your registered email or to act while logged in. We charge no fee.

14-2. Users in the European Economic Area (EEA) and the United Kingdom (GDPR · UK GDPR)

Legal bases:

Your rights:

• You can ask for access (a copy), rectification, erasure, restriction of processing and portability (receiving your sign-up information and cloud save in a machine-readable format (JSON) or having them sent elsewhere).
• You can object to processing based on legitimate interests; objections to marketing (direct marketing) are always accepted without a reason.
• You can withdraw consent at any time: for marketing emails as in section 1, and for personalized ads in the game under Settings → Ad privacy settings (this reopens Google's consent form). Withdrawal does not make earlier processing unlawful.
• We make no fully automated decisions with legal or similarly significant effects (section 7).
• We answer requests within one month; for complex or numerous requests we may extend this by two more months and tell you why.
• You may lodge a complaint with the data protection supervisory authority where you live, work or where the infringement took place (EU authorities: edpb.europa.eu · UK: the Information Commissioner's Office, ico.org.uk). If you tell us first, we will try to resolve it quickly.

International transfers and safeguards:

• Transfers from the EEA and the UK to the Republic of Korea rely on the European Commission's adequacy decision for the Republic of Korea (December 17, 2021) and the UK's adequacy regulations for the Republic of Korea (in force since December 19, 2022).
• Onward transfers from Korea to the USA (Resend, Microsoft and Google in section 5) rely on safeguards recognized by law, such as the recipient's certification under the EU-U.S. Data Privacy Framework (including the UK Extension) or the EU Standard Contractual Clauses (for the UK, the International Data Transfer Addendum) included in each company's data processing terms. We will provide a copy or description of the safeguards on request.

14-3. California residents (CCPA · CPRA)

• Categories of personal information collected in the last 12 months: identifiers (email address, account number, racer name, IP address, advertising identifier), internet and network activity (login and security logs, ad request, view and click records, board posts), device information (model, OS version, app version), commercial information (paid product purchase records — currently sold only in the Republic of Korea). The only sensitive personal information is account login credentials (email and password), used only to provide the account. We do not collect precise location, payment card details or inferred profiles.
• Sources: you, your device (automatically), and Google (if you use Google login).
• Purposes and retention: as in sections 1 and 2.
• Disclosure for business purposes: to service providers (sections 4 and 5 — Amazon Web Services, Resend, Microsoft), only as needed to run the Service.
• No sale or sharing: the Studio does not sell personal information and does not "share" it for cross-context behavioral (personalized) advertising. For users in U.S. states with privacy laws (such as California), we apply Google's "restricted data processing" for ads, so Google does not use that information for personalized ads in rewarded ads. We do not sell or share personal information of anyone under 16.
• Your rights: to know (categories and specific pieces), to delete, to correct, to opt out of sale or sharing, to limit the use of sensitive personal information (we do not use it beyond the purpose above), and not to be discriminated against for exercising your rights. Send requests to the contact above; we verify you through your registered email and answer within 45 days (extendable by 45 more days with notice). An authorized agent must include written authorization.

14-4. Users in Japan (Act on the Protection of Personal Information)

• Provision to third parties in foreign countries: the Studio is a business located in the Republic of Korea and processes the personal information of users in Japan on servers in Korea, and entrusts or provides it to the recipients in section 5 (USA — Resend, Microsoft, Google).
• Personal information protection systems of those countries: the Republic of Korea has the Personal Information Protection Act, supervised by the Personal Information Protection Commission. The USA has no comprehensive federal privacy law, but has sector-specific federal laws and state laws (such as California's CCPA).
• Measures by the recipients: through each company's data processing terms and similar arrangements, the recipients maintain systems that meet the standards of Japan's Act (equivalent measures). We will tell you the details and how we check them without delay on request.
• Security control measures are as in section 9 and are carried out with an understanding of the systems of the countries above.
• Retained personal data: you can request notice of the purposes of use, disclosure (including records of provision to third parties), correction, addition or deletion, suspension of use or erasure, and suspension of provision to third parties at the contact above, free of charge. Business: HK (에이치케이; game brand Aurel Studio) · Representative: Yu Jae-young · Address: 1116, 53 Oncheon-ro, Yuseong-gu, Daejeon, Republic of Korea.

14-5. Other countries and regions

You can exercise the rights your local law gives you through the contact in section 11, and you may also complain to your country's data protection authority.