Demon Ark: Idle RPGPrivacy Policy
This document is a translation of the Korean original. If this translation and the Korean original differ, the Korean original prevails. View the Korean original
GravityStar Games (the “Company”) complies with applicable laws, including the Personal Information Protection Act of the Republic of Korea, and processes users’ personal information only to the extent necessary.
1. Scope
This Privacy Policy applies to the Company’s mobile and PC games, account linking, cloud saves, in-app purchases, customer support, and related webpages (the “Services”).
2. Personal information we process
| Category | Information processed | Purpose |
|---|---|---|
| Accounts and authentication | Service account ID, support code, login provider (Google or Steam), provider user ID, email address and display name when supplied, account-linking status, authentication and session information | Login, account creation and linking, prevention of misuse, account recovery, and customer support |
| Device and usage records | Hash of the device installation identifier, hash of the IP address, device label, platform and operating-system type, app version, build number, API and save-schema versions, language and time zone, request ID, access times, feature usage, and error status | Providing the Services, synchronization between devices, security and rate limiting, incident response, and quality improvement |
| Game data | Nickname, progress, owned heroes, equipment, items and currencies, combat, reward, mail and coupon records, settings, cloud saves, and conflict-recovery copies | Saving and restoring progress, synchronization across devices and platforms, customer support, and investigation of misuse |
| Purchases and refunds | Store, product ID, transaction and order identifiers, purchase-token hash, receipts and verification results, reward-grant records, purchase entitlements, refund and recovery records, and unsettled-transaction records | Payment verification, product delivery and recovery, prevention of duplicate grants, refund and dispute handling, and compliance with legal obligations |
| Consent and rights requests | Terms and Privacy Policy versions, consent timestamps, and account-deletion request, cancellation and completion timestamps | Maintaining consent records, renewed policy consent, handling user requests, and compliance with legal obligations |
| Customer support | Email address, inquiry content, attachments, support code, and inquiry and handling records | Reviewing inquiries, verifying identity and transactions, and resolving incidents and disputes |
The Company does not directly collect resident registration numbers, credit-card numbers, or passwords. Payment-method information is processed by the relevant store, such as Google Play or Steam.
How we access, use, store and share Google user data
- Access: When you sign in with Google or link a Google account, we receive, through our authentication service (Supabase) and within the scope you approve on Google’s consent screen, your basic Google profile information: your Google account ID, email address, name and profile picture URL. We do not access your Google password, contacts, files, email or any other Google account data.
- Use: We use this information only for sign-in and account identification, account linking, cloud saves and purchase recovery, prevention of misuse, and customer support. The game does not use your profile picture, and we do not use Google account information for advertising or marketing.
- Storage: It is stored on the Supabase systems described in Section 7 over encrypted connections and kept for the periods in Section 5. When account deletion is completed, it is deleted or replaced with substitute values as described in Section 8.
- Sharing: We do not sell Google user data and do not share it with third parties except as described in Sections 6 and 7.
- Our use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
3. How information is collected
- When a user logs in with Google or Steam or links an account.
- Information is automatically generated and transmitted when a user runs the game or uses features such as cloud saves, purchases, coupons, mail, and reward claims.
- When a user contacts customer support by email.
- When a store provides purchase or refund verification results to the Company.
4. Grounds for processing
The Company processes personal information to enter into and perform the service contract, on the basis of users’ consent, for the Company’s legitimate interests in service security and preventing misuse, and to comply with legal obligations. Where consent is required, information is processed only within the scope of that consent.
5. Retention periods
| Information | Retention period |
|---|---|
| Account, authentication, and cloud game data | Until membership withdrawal or completion of account deletion. After the seven-day cancellation grace period following a deletion request, directly identifying information and cloud save data are deleted or de-identified. |
| General request, security, and audit logs | In principle, one year from creation; records involved in a security incident or dispute investigation may be retained until resolution. |
| Account-linking conflict and customer-support recovery copies | Thirty days from creation. |
| Contract and withdrawal records, payment records, and records of goods supplied | Five years. |
| Consumer complaint and dispute-handling records | Three years. |
| Display and advertising records | Six months, where applicable. |
Where applicable law requires a longer retention period, or records are needed for litigation, investigations, or disputes, the Company may retain them separately to the minimum extent necessary for that purpose.
6. Disclosure to third parties
As a general rule, the Company does not sell or disclose users’ personal information to third parties. However, information may be disclosed to the extent necessary where the user has consented in advance, where disclosure is necessary to perform the service contract, where there is a legal basis, or in response to a request made through lawful procedures.
Google login, Google Play payments, and Steam login and payments are processed through integration with the platforms selected by the user. Information processed independently by those platforms is subject to their respective privacy policies.
7. Service providers and overseas processing
The Company uses the following providers’ systems to deliver the Services. Users who do not want their information transferred overseas may refrain from using account-based online features or request deletion. This may restrict access to core features such as login, cloud saves, and purchase recovery.
| Provider and country | Information and purpose | Timing, method, and retention |
|---|---|---|
| Supabase, Inc. — India (Mumbai project region; operational support in the countries of its publicly listed subprocessors) | Account and authentication information, hashed device and IP identifiers, game saves, purchases and refunds, and usage and security logs; operation of backend, database, authentication, and Edge functions | Transmitted over encrypted connections when online features are used; retained until membership withdrawal or the applicable category-specific retention period. Backups are retained for a limited period under the provider’s policies. |
| Google LLC — United States and countries where Google operates its services | Google account identifiers, email address and display name when supplied, authentication tokens, Google Play product, transaction and purchase-verification information, and customer-support emails; login, payment verification, and email inquiries | Encrypted transmission during login, purchases, and inquiries; retention under Google’s policies and applicable statutory periods. |
| Valve Corporation — United States and countries where Valve operates its services | SteamID, display name, authentication tickets, and product, order, transaction and refund information; Steam login and payment verification | Encrypted transmission during login, purchases, and refunds; retention under Valve’s policies and applicable statutory periods. |
| Cloudflare, Inc. — United States and countries where Cloudflare operates its network | IP address, browser and device information, and request records when visiting this website (gravitystargames.com); website hosting, delivery and security | Encrypted transmission when the website is visited; retained for the periods specified in Cloudflare’s Privacy Policy. |
| Notion Labs, Inc. — United States and other countries | Access, device and cookie information when visiting archived earlier versions of these documents on Notion; webpage hosting and security | Transmitted when those documents are visited; retained for the periods specified in Notion’s Privacy Policy. |
The Company reviews the personal-information safeguards of its processors and service providers and protects information through contractual measures and supervision where necessary.
8. Destruction procedures and methods
Personal information is destroyed without delay when its retention period expires or its processing purpose has been fulfilled. Electronic files are deleted using methods that make recovery difficult, and paper documents are shredded or incinerated. When account deletion is completed, email addresses, display names and external provider IDs are deleted or replaced with substitute values, sessions are revoked, and cloud save data is deleted.
Information retained under law or for a legitimate reason, such as payment, refund, security, or legal-dispute records, is kept separately from other information and only for the period needed for that purpose.
9. Your rights and how to exercise them
Users may request access to, correction or deletion of their personal information, suspension of processing, withdrawal of consent, and account deletion.
- In the app: Settings > Account > Delete Account.
- Email: gravitystargames@gmail.com.
- On the web: follow the procedures on the Account & Data Deletion page.
The Company may verify the requester’s identity. Where retention is required by law or a request could infringe another person’s rights, the Company may restrict part of the request and explain why.
10. Children under 14
The Services are not directed at children under 14, and the Company does not knowingly collect their personal information. If the Company learns that a child under 14’s information was collected without the consent of a legal representative, it will delete the information without delay and take necessary measures.
11. Security measures
The Company applies reasonable technical and organizational measures, including encryption in transit, protection of authentication information, least-privilege access control, separation of server privileges, hashing of identifying information, masking of secrets such as tokens and receipts in logs, blocking of duplicate and fraudulent requests, and security reviews.
12. Advertising and analytics technologies
The current Services do not include personalized-advertising SDKs or separate behavioral-analytics SDKs. If advertising or analytics features are introduced, the Company will disclose the information collected, purposes, providers, and opt-out methods in this Policy in advance and obtain any required consent.
This website is delivered through Cloudflare, and the Company does not use cookies or analytics tools on this website. Cloudflare may set strictly necessary cookies for security. Archived earlier versions of these documents on Notion may use Notion’s cookies or similar technologies; please consult Notion’s Privacy Policy for details.
13. Person responsible for personal-information protection
- Responsible person: the representative of GravityStar Games.
- Email: gravitystargames@gmail.com.
Personal-information inquiries, rights requests, and requests for assistance may be sent to this contact.
14. Assistance with privacy infringements
For consultation or reports about personal-information infringements, users may contact the relevant authorities, including the Personal Information Portal and the Personal Information Infringement Report Center.
15. Changes to this Policy
Changes will be announced through the Services or this webpage at least seven days before taking effect. Changes that are materially unfavorable to users’ rights will be announced at least thirty days in advance, and any consent required by applicable law will be obtained.
Change history
- Effective October 30, 2026 (announced October 23, 2026): With the move to our official website (gravitystargames.com), we added the website hosting provider (Cloudflare) to Section 7 and limited the Notion entry to archived earlier versions of these documents. We added a description in Section 2 of the Google information received at sign-in and how it is used, stored and shared. Processing purposes and retention periods are unchanged. The previous version applies until the effective date.
- August 3, 2026: Original announcement and effective date. View previous version (Korean)