Privacy Policy

Published: September 30, 2026 / Effective Date: September 30, 2026

GamePal ("we", "us", or "our") takes your privacy seriously and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our services.

GamePal is an adults-only service. All users must be at least 18 years old, and users who reside in the Republic of Korea must be at least 19 years old (see Section 12). We do not knowingly collect personal information from children.

1. Information We Collect

• Required Information: Email address, phone number, date of birth, gender, nickname, profile information, profile photos (2 or more), gaming-related information (play style, favorite games, etc.)
• Information collected upon game account linking (with user consent):
  • Riot Games: Riot ID, rank, win/loss records, champion and agent statistics
  • Steam: Steam ID, owned games list, playtime
  • Battle.net: BattleTag, game-specific rank and character information
  • Discord: Discord username, link status
• Optional Information: Marketing preferences, interest information
• Automatically Collected: Service usage records, device information (OS, model, etc.), IP address, cookies, advertising identifier (iOS IDFA / Android Advertising ID), ad impression and click records, install source (organic or not, media source, campaign) (see Section 6 for information collected by in-app advertising and measurement SDKs)

2. How We Use Your Information

• Service provision and contract fulfillment: account registration, identity verification, matching services, personalized recommendations
• AI image generation: creating avatar and card images based on photos uploaded by users
• Service improvement: usage analysis, new service development
• Customer support: inquiry responses, notifications, dispute resolution
• Marketing and advertising: event information (only with consent to receive marketing messages), serving in-app ads, personalized ads (Section 6-2 - unless you opt out), and advertising performance measurement (only with consent under Section 4-1)

3. Data Retention

• Until account deletion: Basic information required for service provision
• Upon game account unlinking: Associated game account data is immediately deleted
• Party stats lookup: Data is temporarily processed through third-party APIs and is not stored separately
• Source photos for AI image generation: Retained until account deletion (for reuse when regenerating cards); destroyed without delay upon withdrawal
• 30 days after deletion: Minimal information for fraud prevention (hashed ID, phone number)
• Install source (organic or not, media source, campaign): Retained until account deletion; destroyed without delay upon withdrawal
• Legal retention: As required by applicable laws and regulations

4. Information Sharing

We do not sell or share your personal information with third parties except in the following cases:

• With your prior consent
• As required by law or legal process
• For statistical purposes in anonymized form

4-1. Sharing for Advertising Measurement (Optional Consent)

Only where you have given consent, we share the following information with advertising partners to measure advertising performance. Consent is optional, and declining does not restrict your use of the core service. You can withdraw consent per partner at any time in the app under My Page > Privacy & Security > Privacy Settings > Marketing Partners.

• Meta Platforms, Inc. (advertising measurement)
  • Data shared: Advertising identifier (IDFA / Android Advertising ID) or an app-issued anonymous identifier, device information, IP address, app usage, sign-up completion and purchase events
  • Purpose: Advertising performance measurement and personalized advertising
  • Retention: As set out in the recipient privacy policy

The Marketing Partners settings in the app and the optional consent at sign-up also cover AppsFlyer Ltd., our measurement processor under Section 5. This item is consent for AppsFlyer to measure app launches and sign-up performance after you sign up; if you do not consent or withdraw consent, data is no longer sent to AppsFlyer (pre-sign-up install measurement is described in Section 6-2).

When you withdraw consent, we ask that partner to stop using your information for advertising measurement from that point onward. Information already shared before withdrawal is handled under each partner own privacy policy.

Ads shown in the app and their personalization (personalized advertising) are not covered by this consent; they are handled by advertising networks under Section 6-2. You can opt out of personalized advertising using the methods in Section 6-2.

5. Data Processing Partners

We work with the following partners to provide our services:

• AWS (Amazon Web Services): Cloud infrastructure and validated service usage log collection through the authenticated API and Kinesis Data Firehose
• Google LLC: AI image generation — processing photos uploaded by users through the Gemini API to create onboarding avatar images
• OpenAI, L.L.C.: AI image generation — processing photos uploaded by users through the image generation API to create concept card images
• Firebase: Push notification services
• Google LLC (Gmail SMTP): Sending account recovery verification code emails
• Riot Games: Game account verification and stats data retrieval (League of Legends, VALORANT, Teamfight Tactics)
• Valve Corporation: Steam account verification and game library retrieval
• Blizzard Entertainment: Battle.net account verification and game data retrieval (Overwatch 2, World of Warcraft, etc.)
• KRAFTON: PUBG stats data retrieval
• OpenDota: Dota 2 stats data retrieval
• Nimble Neuron: Eternal Return stats data retrieval
• Discord: Account linking and voice chat connection
• RevenueCat, Inc.: In-app purchase receipt validation, subscription state management, and purchase event delivery
• Functional Software, Inc. (Sentry): Application error and performance diagnostics
• Expo, Inc.: Over-the-air (OTA) application update delivery
• Kakao Corp.: Kakao account sign-in and sharing features
• AppsFlyer Ltd.: Measuring app install sources and installs and sign-ups by ad and link (after sign-up, only with marketing partner consent)

6. Cookies and Tracking

6-1. Cookies

We use cookies for service usage analysis. You can disable cookies through your browser settings, but this may limit service functionality.

6-2. Behavioral Information Collected Automatically by In-App Advertising SDKs

The app includes software development kits (SDKs) from advertising networks to serve ads. When the app requests an ad, the advertising networks below collect the following information directly through their SDKs. This collection happens as part of serving ads, whether or not you have consented under Section 4-1. We do not provide advertising networks with information that identifies you as a member (such as your name, contact details or member identifier), and we do not combine the information they collect with your account information.

• Advertising networks: Google LLC (Google AdMob), Unity Technologies S.F. (Unity Ads), Meta Platforms, Inc. (Meta Audience Network)
• Data collected: Device information (OS, model, language settings, etc.), IP address, app information, ad impression and click records, and the advertising identifier (IDFA / Android Advertising ID) where your device settings allow it
• How it is collected: Automatically by the advertising SDKs in the app when an ad is requested
• Purpose: Ad auctions and serving, counting ad impressions and clicks, preventing ad fraud, and interest-based personalized advertising (if you opt out using the methods below, you will see non-personalized ads instead)
• Users in the European Economic Area, the United Kingdom or Switzerland: personalized advertising is provided only if you turn on 'Personalized ads' in the app settings
• Retention: As set out in each advertising network privacy policy

In addition, the Meta SDK included in the app collects the following information to measure advertising performance (app installs).

• Collected by: Meta Platforms, Inc. (Meta SDK - advertising measurement)
• Data collected: App install and launch events, device information, IP address, and the advertising identifier (IDFA / Android Advertising ID) where your device settings allow it
• When: From app installation and first launch, before you sign up (before your consent under Section 4-1 is known)
• Purpose: Measuring the performance of app install ads
• After sign-up: If you do not consent under Section 4-1 or withdraw consent, automatic app event collection and advertising identifier collection stop. However, device information needed to initialize the SDK for install attribution may continue to be sent.
• Retention: As set out in the Meta privacy policy

To measure install sources, the AppsFlyer SDK included in the app collects the following information. AppsFlyer processes this information on our behalf as a data processor (Section 5).

• Collected by: AppsFlyer Ltd. (AppsFlyer SDK - install source measurement)
• Data collected: App install and launch information, ad and link click information, device information, IP address, and the advertising identifier (IDFA / Android Advertising ID) where your device settings allow it
• When: From app installation and first launch, before you sign up (before your consent under Section 4-1 is known)
• Purpose: Measuring app installs and sign-ups by ad and link. We store only the install classification, media source and campaign determined by AppsFlyer when you sign up (raw identifiers are not stored)
• After sign-up: If you do not consent to AppsFlyer, or withdraw consent, in the app's Marketing Partners settings, data is no longer sent to AppsFlyer.
• Retention: AppsFlyer retains the data for up to 24 months, except where we direct otherwise or the law requires

You can refuse or limit behavioral data collection and personalized advertising as follows.

• In the app: Turn off 'Personalized ads' under My Page > Privacy & Security > Privacy Settings > Marketing Partners to stop or limit personalized advertising by the advertising networks above. Because the effect of this request differs by operating system for some networks, please also use the device settings below if you want to fully limit ad tracking.
• iOS: If you do not allow the app to track you under Settings > Privacy & Security > Tracking, the advertising identifier (IDFA) is not passed to advertising networks.
• Android: If you delete your advertising ID under Settings > Privacy (or Google, depending on your device) > Ads, the advertising ID is not passed to advertising networks.

Collection of the minimum information needed to serve ads (device information, IP address, etc.) cannot be separated from displaying ads, so it may continue while ads are shown even if you use the settings above.

7. Security Measures

• Technical measures: Data encryption, access controls, security software
• Administrative measures: Limited access, regular training

8. Your Rights

You have the right to:

• Access your personal information
• Correct or update your information
• Delete your account and data
• Withdraw consent for data processing

9. Contact Information

For privacy-related inquiries:

• Name: KIM SEUNGGU
• Title: CEO
• Contact: privacy@gamepal.co

10. International Transfers

Your data may be transferred to and processed in countries other than your own. We minimize international transfers and, where they are necessary to provide our services, process them per processor and advertising network as follows. We ensure appropriate safeguards are in place for such transfers:

• AWS (Amazon Web Services, Inc.)
  • Destination country: United States
  • Data transferred: Personal information stored for service provision
  • Purpose of transfer: Data storage on cloud infrastructure
  • Retention period: Until account deletion. The account-linking key for service usage logs is deleted immediately upon withdrawal; de-linked anonymous statistics are retained for up to 360 days from collection and then deleted. Logs in the previous identifier format are placed under a one-day expiration policy when the new system is introduced
• Google LLC
  • Destination country: United States
  • Data transferred: Photos uploaded by users for AI image generation
  • Purpose of transfer: Onboarding avatar image generation processing through the Gemini API
  • Retention period: Not retained for generation purposes; safety-review logs may be kept for a limited period under Google policy
• OpenAI, L.L.C.
  • Destination country: United States
  • Data transferred: Photos uploaded by users for AI image generation
  • Purpose of transfer: Concept card image generation processing through the image generation API
  • Retention period: Not retained for generation purposes; abuse-monitoring logs may be kept for up to 30 days under OpenAI policy
• Google LLC (Gmail SMTP)
  • Destination country: United States
  • Data transferred: Email address, verification code
  • Purpose of transfer: Sending account recovery verification code emails
  • Retention period: Not retained after sending is complete
• RevenueCat, Inc.
  • Destination country: United States
  • Data transferred: User identifier, purchase records, device information
  • Purpose of transfer: In-app purchase receipt validation and subscription state management
  • Retention period: Until account deletion
• Expo, Inc.
  • Destination country: United States
  • Data transferred: App version, device information and other data required for update delivery
  • Purpose of transfer: Over-the-air (OTA) application update delivery
  • Retention period: For the period required to deliver updates
• Functional Software, Inc. (Sentry)
  • Destination country: United States
  • Data transferred: Device information, application state and user identifier at the time of an error
  • Purpose of transfer: Application error and performance diagnostics
  • Retention period: 90 days from collection
• AppsFlyer Ltd. - pre-sign-up install source measurement under Section 6-2, and after sign-up where you have given marketing partner consent
  • Destination country: Israel (headquarters), United States
  • Data transferred: App install and launch information, ad and link click information, device information, IP address, and the advertising identifier where your device settings allow it
  • Timing and method of transfer: Sent over the network through the AppsFlyer SDK when the app runs
  • Purpose of transfer: Measuring app install sources and installs and sign-ups by ad and link
  • Retention period: Up to 24 months (except where we direct otherwise or the law requires)
• Meta Platforms, Inc. (advertising measurement) - where you have consented under Section 4-1, and for pre-sign-up install and launch measurement under Section 6-2
  • Destination country: United States
  • Data transferred: Advertising identifier or app-issued anonymous identifier, device information, IP address, app usage, sign-up completion and purchase events
  • Purpose of transfer: Advertising performance measurement and personalized advertising
  • Retention period: As set out in the recipient privacy policy
• Google LLC (Google AdMob), Unity Technologies S.F. (Unity Ads), Meta Platforms, Inc. (Meta Audience Network) - ad serving and personalized advertising information under Section 6-2
  • Destination country: United States (Unity Technologies S.F. may further transfer data to countries where its affiliates are located, such as Israel, Canada, Japan and the United Kingdom)
  • Data transferred: Device information, IP address, app information, ad impression and click records, and the advertising identifier where your device settings allow it
  • Timing and method of transfer: Sent over the network through the advertising SDKs when the app requests an ad
  • Purpose of transfer: Ad auctions and serving, counting ad impressions and clicks, preventing ad fraud, and interest-based personalized advertising (except where you have opted out under Section 6-2)
  • Retention period: As set out in each advertising network privacy policy

You have the right to refuse the international transfer of your personal information. However, if you refuse, your use of features that depend on such processing (such as the AI image generation feature) may be limited.

11. Changes to This Policy

This Privacy Policy takes effect on September 30, 2026. When we change it, we will post the changes and their effective date in Notices before or when they take effect.

Previous versions of this Privacy Policy are available below.

• August 29, 2026 - September 29, 2026
• August 22, 2026 - August 28, 2026
• August 5, 2026 - August 21, 2026
• Through August 4, 2026

12. Minimum Age and Children's Privacy

• GamePal is an adults-only service. All users must be at least 18 years old. Users who reside in the Republic of Korea must be at least 19 years old, in line with the age of majority under Korean youth protection law.
• This age requirement is determined by your country of residence, not by the language you have selected.
• We do not knowingly collect personal information from anyone below the applicable minimum age, and we verify age using the date of birth entered at sign-up.
• If we learn that we have collected personal information from someone below the applicable minimum age, we suspend the account immediately and delete the information without undue delay. Such cases can be reported to our customer support.

Effective Date: This Privacy Policy applies from September 30, 2026.