Privacy Policy

Published: August 6, 2026 / Effective Date: August 22, 2026

GamePal ("we", "us", or "our") takes your privacy seriously and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our services.

GamePal is an adults-only service. All users must be at least 18 years old, and users who reside in the Republic of Korea must be at least 19 years old (see Section 12). We do not knowingly collect personal information from children.

1. Information We Collect

• Required Information: Email address, phone number, date of birth, gender, nickname, profile information, profile photos (2 or more), gaming-related information (play style, favorite games, etc.)
• Information collected upon game account linking (with user consent):
  • Riot Games: Riot ID, rank, win/loss records, champion and agent statistics
  • Steam: Steam ID, owned games list, playtime
  • Battle.net: BattleTag, game-specific rank and character information
  • Discord: Discord username, link status
• Optional Information: Marketing preferences, interest information
• Automatically Collected: Service usage records, device information (OS, model, etc.), IP address, cookies, advertising identifier (iOS IDFA / Android Advertising ID)

2. How We Use Your Information

• Service provision and contract fulfillment: account registration, identity verification, matching services, personalized recommendations
• AI image generation: creating avatar and card images based on photos uploaded by users
• Service improvement: usage analysis, new service development
• Customer support: inquiry responses, notifications, dispute resolution
• Marketing and advertising: event information, personalized ads (with consent only)

3. Data Retention

• Until account deletion: Basic information required for service provision
• Upon game account unlinking: Associated game account data is immediately deleted
• Party stats lookup: Data is temporarily processed through third-party APIs and is not stored separately
• Source photos for AI image generation: Retained until account deletion (for reuse when regenerating cards); destroyed without delay upon withdrawal
• 30 days after deletion: Minimal information for fraud prevention (hashed ID, phone number)
• Legal retention: As required by applicable laws and regulations

4. Information Sharing

We do not sell or share your personal information with third parties except in the following cases:

• With your prior consent
• As required by law or legal process
• For statistical purposes in anonymized form

4-1. Sharing with Advertising and Marketing Partners (Optional Consent)

Only where you have given consent, we share the following information with advertising partners to deliver personalized advertising and measure advertising performance. Consent is optional, and declining does not restrict your use of the core service. You can withdraw consent per partner at any time in the app under My Page > Privacy Settings > Marketing Partners.

• Meta Platforms, Inc.
  • Data shared: Advertising identifier (IDFA / Android Advertising ID) or an app-issued anonymous identifier, device information, IP address, app usage, sign-up completion and purchase events
  • Purpose: Advertising performance measurement and personalized advertising
  • Retention: As set out in the recipient privacy policy
• Google LLC (Google AdMob)
  • Data shared: Advertising identifier (IDFA / Android Advertising ID), device information, IP address
  • Purpose: Serving in-app advertising and personalized advertising
  • Retention: As set out in the recipient privacy policy

Withdrawing consent stops further transmission from that point onward. Information already shared before withdrawal is handled under each partner own privacy policy. Withdrawing consent does not remove advertising itself; non-personalized advertising may continue to appear.

5. Data Processing Partners

We work with the following partners to provide our services:

• AWS (Amazon Web Services): Cloud infrastructure, user authentication (Cognito), and service usage log collection and delivery (Kinesis Data Firehose)
• Google LLC: AI image generation — processing photos uploaded by users through the Gemini API to create avatar and card images
• Firebase: Push notification services
• Google LLC (Gmail SMTP): Sending account recovery verification code emails
• Riot Games: Game account verification and stats data retrieval (League of Legends, VALORANT, Teamfight Tactics)
• Valve Corporation: Steam account verification and game library retrieval
• Blizzard Entertainment: Battle.net account verification and game data retrieval (Overwatch 2, World of Warcraft, etc.)
• KRAFTON: PUBG stats data retrieval
• OpenDota: Dota 2 stats data retrieval
• Nimble Neuron: Eternal Return stats data retrieval
• Discord: Account linking and voice chat connection
• RevenueCat, Inc.: In-app purchase receipt validation, subscription state management, and purchase event delivery
• Functional Software, Inc. (Sentry): Application error and performance diagnostics
• Expo, Inc.: Over-the-air (OTA) application update delivery
• Kakao Corp.: Kakao account sign-in and sharing features

6. Cookies and Tracking

We use cookies for service usage analysis. You can disable cookies through your browser settings, but this may limit service functionality.

7. Security Measures

• Technical measures: Data encryption, access controls, security software
• Administrative measures: Limited access, regular training

8. Your Rights

You have the right to:

• Access your personal information
• Correct or update your information
• Delete your account and data
• Withdraw consent for data processing

9. Contact Information

For privacy-related inquiries:

• Name: KIM SEUNGGU
• Title: CEO
• Contact: privacy@gamepal.co

10. International Transfers

Your data may be transferred to and processed in countries other than your own. We minimize international transfers and, where they are necessary to provide our services, process them per processor as follows. We ensure appropriate safeguards are in place for such transfers:

• AWS (Amazon Web Services, Inc.)
  • Destination country: United States
  • Data transferred: Personal information stored for service provision
  • Purpose of transfer: Data storage on cloud infrastructure
  • Retention period: Until account deletion
• Google LLC
  • Destination country: United States
  • Data transferred: Photos uploaded by users for AI image generation
  • Purpose of transfer: AI image generation processing through the Gemini API
  • Retention period: Not retained for generation purposes; safety-review logs may be kept for a limited period under Google policy
• Google LLC (Gmail SMTP)
  • Destination country: United States
  • Data transferred: Email address, verification code
  • Purpose of transfer: Sending account recovery verification code emails
  • Retention period: Not retained after sending is complete
• RevenueCat, Inc.
  • Destination country: United States
  • Data transferred: User identifier, purchase records, device information
  • Purpose of transfer: In-app purchase receipt validation and subscription state management
  • Retention period: Until account deletion
• Expo, Inc.
  • Destination country: United States
  • Data transferred: App version, device information and other data required for update delivery
  • Purpose of transfer: Over-the-air (OTA) application update delivery
  • Retention period: For the period required to deliver updates
• Functional Software, Inc. (Sentry)
  • Destination country: United States
  • Data transferred: Device information, application state and user identifier at the time of an error
  • Purpose of transfer: Application error and performance diagnostics
  • Retention period: 90 days from collection
• Meta Platforms, Inc. - only where you have consented under Section 4-1
  • Destination country: United States
  • Data transferred: Advertising identifier or app-issued anonymous identifier, device information, IP address, app usage, sign-up completion and purchase events
  • Purpose of transfer: Advertising performance measurement and personalized advertising
  • Retention period: As set out in the recipient privacy policy
• Google LLC (Google AdMob) - only where you have consented under Section 4-1
  • Destination country: United States
  • Data transferred: Advertising identifier, device information, IP address
  • Purpose of transfer: Serving in-app advertising and personalized advertising
  • Retention period: As set out in the recipient privacy policy

You have the right to refuse the international transfer of your personal information. However, if you refuse, your use of features that depend on such processing (such as the AI image generation feature) may be limited.

11. Changes to This Policy

This Privacy Policy takes effect on August 22, 2026. We may update it from time to time, and we will notify you of any material changes at least 7 days before they take effect.

Previous versions of this Privacy Policy are available below.

• August 5, 2026 - August 21, 2026
• Through August 4, 2026

12. Minimum Age and Children's Privacy

• GamePal is an adults-only service. All users must be at least 18 years old. Users who reside in the Republic of Korea must be at least 19 years old, in line with the age of majority under Korean youth protection law.
• This age requirement is determined by your country of residence, not by the language you have selected.
• We do not knowingly collect personal information from anyone below the applicable minimum age, and we verify age using the date of birth entered at sign-up.
• If we learn that we have collected personal information from someone below the applicable minimum age, we suspend the account immediately and delete the information without undue delay. Such cases can be reported to our customer support.

Effective Date: This Privacy Policy applies from August 22, 2026.