Minicar Champion Road Privacy Policy
This is an English translation. If it differs from the Korean version, the Korean version prevails.
Aurel Studio ("the Studio") runs the online racing RPG "Minicar Champion Road" and its official website ("the Service") and processes users' personal information as follows under the Personal Information Protection Act of the Republic of Korea.
The offline beta played without the internet (app 1.5–1.6) does not collect personal information and is covered by the separate privacy policy for the offline version. This policy applies to the online version you log in to with an account (app 2.0 and later) and to the official website.
1. Personal information we process, purposes, legal bases and retention
| Category | Items | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Sign-up and login | Email, password (stored only as a salted hash), account number, consent records (Terms and policy versions, 14+ confirmation, time) | Identifying members and logging in, verifying identity, important notices | Contract | Until the account is deleted |
| Racer name | The racer name set per account | The name other users see (the official website board, etc.) | Contract | Until the account is deleted |
| Auto-login | Device identifier (a hash of the device ID) | Keeping you logged in on this device | Contract | Until the account is deleted (deleted for that device at once when you log out or turn auto-login off) |
| Two-step verification (optional) | Mobile number (only if you turn on SMS verification; stored encrypted), backup codes (stored only as irreversible values), code request records (time, method) | Verifying identity when logging in on a new device | Contract (when you turn it on) | Until you turn it off or delete the account (the mobile number is deleted as soon as you turn it off) · request records 1 year |
| Google login (optional) | Google account identifier, Google account email | Signing up and logging in with a Google account | Contract | Until the account is deleted |
| Gameplay | Cloud save (save slots, story progress, machines, parts, in-game currencies, race records, game settings, offline beta participation record) | Providing the game, continuing on other devices | Contract | Until the account is deleted |
| Save history | Earlier versions of the cloud save (latest 5 + one per day for 7 days) | Restoring lost or broken progress (on request) | Contract | Deleted automatically beyond that number and period |
| Security logs | Time and method of sign-up and login (email, Google, auto-login), failed logins to existing accounts, save conflicts, two-step verification and password reset requests, and the IP address at those times | Protecting accounts, preventing abuse, handling disputes | Legitimate interest, law | 1 year (IP addresses 3 months) |
| Website board | Posts and comments, the name shown as author, time written, report records (reporting and reported posts, reason) | Providing the board, handling reports | Contract, legitimate interest | Until deleted or the account is deleted (report and sanction records 1 year from the action) |
| Email inquiries | Email address, inquiry contents | Answering, verifying identity | Contract | 1 year after handling |
- Legal bases: Contract = performing the service agreement (Article 15(1)4 of the Personal Information Protection Act), legitimate interest = item 6 of the same paragraph, law = item 2 of the same paragraph (Protection of Communications Secrets Act — access logs). All of the above can be processed without consent, and we state the bases separately under Article 22(3) of the same Act. If we need to process personal information for any other purpose, we will ask for separate consent first.
- Security logs are linked to the account number. We do not log login attempts with email addresses that have no account.
- You can turn auto-login on or off per device (off by default on PC). Turning on two-step verification signs out auto-login on devices other than the current one.
- Other users can see your racer name and board posts. Your email address is not shown to other users.
- "Send feedback" in the game only opens your mail app to write an email; the app sends nothing by itself. The message is prefilled only with the app version, device model, OS version and game progress, and you can edit it before sending.
- We do not process payment information, sensitive information or pseudonymized information, and we use no advertising or analytics tools (SDKs). We do not collect location information.
2. Destruction procedures and methods
- Personal information whose retention period has ended or whose purpose has been achieved is destroyed without delay (within 5 days at the latest).
- When you delete your account, the account, racer name, cloud save and save history, two-step verification data and board posts/comments are deleted from the live database at once, and that account's progress on the device is also deleted. The account deletion record (account number and time of deletion — to confirm deletion and handle disputes) and report/sanction records are kept for 1 year, and email inquiries for 1 year after handling, then deleted. Details are in "Account Deletion".
- Daily database backups are deleted automatically after 14 days, and server snapshots, if used, after 7 days. Backups are used only for disaster recovery; even if the server is restored from a backup, deleted accounts are deleted again.
- Under the Protection of Communications Secrets Act, access logs (IP address, access time) are kept for 3 months.
- Electronic files are deleted so they cannot be recovered. We do not keep personal information on paper.
3. Provision to third parties
The Studio does not provide personal information to third parties, except where the law specifically requires it, such as a request by an investigative agency under legal procedures.
4. Outsourcing of processing
| Processor | Work | Period |
|---|---|---|
| Amazon Web Services Korea LLC | Running the game server, database and official website (AWS Lightsail, Seoul region), storing backups | Until the outsourcing contract ends |
| Resend, Inc. (USA) — when enabled | Sending verification code emails (two-step verification, password reset) | Until the outsourcing contract ends |
| SOLAPI Inc. (주식회사 솔라피) — when enabled | Sending verification code text messages (SMS two-step verification) | Until the outsourcing contract ends |
"When enabled" means the processing is outsourced from the time that sending feature is turned on. Until then the feature cannot be used, and the screen says so.
5. Transfer abroad
Personal information for the game server, database and official website is stored in the Republic of Korea (AWS Seoul region, ap-northeast-2), and information of users who connect from abroad is also processed in Korea. It is transferred abroad only in the following cases.
| Recipient (country) | Items | When and how | Purpose | Retention |
|---|---|---|---|---|
| Resend, Inc. (USA) — after email sending is enabled | Recipient email address, verification code and email contents | Sent over the network when a code is sent | Sending verification code emails | As long as needed for delivery (per the processor's retention rules) |
| Microsoft Corporation (USA) | The email address and contents you send to the inquiry address (thirtyshots2689@outlook.com) | When the email is received | Answering inquiries | 1 year after handling |
- If you do not want the transfer: you can turn on two-step verification by text message instead of email, or not use two-step verification (password reset works only by email — you can link a Google account instead); and you can leave personal information out of inquiry emails or use the in-game account features (such as account deletion).
6. Rights and duties of data subjects and legal representatives
- You may at any time request access to, correction or deletion of, or suspension of processing of your personal information, and withdraw consent.
- You can check and delete it yourself in the game's "Account" window or the official website's "My info", or ask the Studio from your registered email. A legal representative or an authorized person may also ask, with a power of attorney.
- The Studio informs you of the result within 10 days of the request. If it refuses or limits the request under the law, such as for information other laws require us to keep (e.g., access logs), it tells you why and how to object.
- You must protect your own password and must not infringe other people's personal information.
7. Automated measures
The Studio does not make fully automated decisions that significantly affect users' rights or duties. However, to keep the board orderly, some profanity is masked automatically, and posts or comments reported by 3 different users are hidden automatically until an operator reviews them. Logging in is also blocked for a short time after many wrong passwords in a short time. If you ask for an explanation or object by email, a person reviews it again.
8. Children under 14
Children under 14 cannot sign up, and we confirm that users are 14 or older at sign-up. If we learn that we have collected information from a child under 14, we delete the account and information at once. A legal representative can request deletion by email.
9. Security measures
- Passwords are stored only as salted hashes and are not kept on the device. Mobile numbers are encrypted, and backup codes and verification codes are stored only as irreversible values.
- All communication is encrypted with TLS (HTTPS, WSS).
- Server administration uses SSH keys only, the admin console is not exposed to the outside, and the firewall allows only the needed connections (web 80/443, admin 22).
- Security updates are applied to the server automatically, and request rate limits and login attempt limits prevent abuse. Irreversible actions such as account deletion happen only after checking the password (or Google account) again.
- Access to personal information is limited to the operator.
- Backups are made daily and deleted automatically after the set period. The servers are under the physical security of AWS data centers.
10. Automatic collection tools and how to refuse them
- The official website keeps your login in the browser's session storage to keep you logged in. It is cleared when you close the browser tab. Your language choice is kept in the browser's local storage.
- We use no advertising or analytics cookies or behavioral tracking tools, and we do not show targeted advertising.
- The game app stores a device identifier and the auto-login setting on the device for auto-login.
- How to refuse: you can block site data storage in your browser settings, but website login may then not work. In the game, turning off auto-login or logging out unlinks the device.
11. Privacy officer
- Contact: Aurel Studio Privacy Officer
- Email: thirtyshots2689@outlook.com
Please use this contact for privacy questions, access requests, complaints and remedies.
12. Remedies for infringement
For advice or dispute mediation about privacy infringement, you can contact the following Korean agencies.
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
- Personal Information Infringement Report Center: 118, privacy.kisa.or.kr
- Supreme Prosecutors' Office: 1301, www.spo.go.kr
- Korean National Police Agency: 182, ecrm.police.go.kr
13. Changes to this policy
When this policy changes, we announce it in an in-game notice and on the official website 7 days before it takes effect (30 days for important changes).
- Version 1.0: effective October 5, 2026