Pilgaek Privacy Policy
This English text is a translation provided for convenience. The Korean version (「필객 개인정보 처리방침」) prevails if the two differ. Section 14 adds information for players in the EEA, the UK and other regions.
Aurel Studio ("we", "us") operates the online RPG Pilgaek and its official homepage (the "Service") and processes your personal information as described below, in accordance with the Personal Information Protection Act of the Republic of Korea ("PIPA").
1. Personal Information We Process, Purposes, Legal Bases and Retention
| Category | Items | Purpose | Basis | Retention |
|---|---|---|---|---|
| Sign-up and login | Email; password (stored only as a salted hash); account number; consent record (versions of the Terms and this Policy, confirmation of age 14+, time) | Identifying members and logging in, verifying identity, important notices | Contract | Until account deletion |
| Automatic login | Device identifier (a hash of the device ID) | Keeping this device logged in | Contract | Until account deletion |
| Two-step verification (optional) | Mobile number (only if you turn it on by text message; stored encrypted), backup codes (stored only as irreversible values), verification request log (time and method) | Confirming it is you when logging in on a new device | Contract (when you turn it on) | Until you turn it off or delete your account (the mobile number is deleted as soon as you turn it off) · request log 1 year |
| Google login | (Once introduced) Google account identifier and email | Logging in with a Google account | Contract | Until account deletion |
| Playing the game | Character names; selected nation; game progress and items; jade ("옥") balance; draw history; friends and block lists; cloud save | Providing the game and saving progress; friends, chat, rankings, nation contest | Contract | Until account deletion |
| Save history | Previous versions of your cloud save (the latest 5, plus one per day for 7 days) | Restoring lost or broken progress (on request) | Contract | Older versions deleted automatically |
| Item and currency log | Jade changes; draw results; acquisition, enhancement and consumption of high-grade items; level and chapter milestones | Verifying and restoring lost items, handling disputes, detecting cheating | Contract, legitimate interest | 1 year |
| Open-beta statistics | Level, play time, kills, items obtained by grade, currency gained and spent (periodic snapshots) | Game balance and service improvement | Legitimate interest | Deleted or anonymized after 1 year |
| Reports and sanctions | Account numbers and character names of the reporting and reported members, reason, the reported chat message, time, sanction details | Handling reports, enforcing the Operation Policy, handling disputes | Legitimate interest | 1 year from the action |
| Homepage board | Posts and comments, the name shown as author, time posted | Providing the board | Contract | Until you delete them or your account |
| Email inquiries | Email address, content of the inquiry | Answering, verifying identity | Contract | 1 year after handling |
| Access logs | IP address, access date and time, server usage records | Preventing abuse and keeping the Service secure, limiting sign-up attempts | Law, legitimate interest | 3 months |
- Bases: Contract = performance of the service agreement (PIPA Article 15(1)(4)); Legitimate interest = Article 15(1)(6); Law = Article 15(1)(2) (Protection of Communications Secrets Act). All of the information above may be processed without consent, and we state its legal bases separately as required by PIPA Article 22(3). If we need to process it for any other purpose, we will first ask for your separate consent.
- The item and currency log and the open-beta statistics are linked to your account number.
- You can turn automatic login on or off for each device (off by default on PCs). When you turn it off or log out, that device's identifier is removed from your account.
- Chat (World, General, Party and Whisper) is only relayed in real time and is not stored. Only a reported chat message is kept in the report record.
- Other players can see your character names, level, nation, appearance and rankings, and your friends can see whether you are online.
- We do not process payment information, sensitive information or pseudonymized information, and we use no advertising or analytics tools (SDKs).
2. Destruction of Personal Information
- We destroy personal information without delay (within 5 days at the latest) when its retention period ends or its purpose has been achieved.
- When you delete your account, we immediately delete your account and game data, save history, item and currency log, open-beta statistics and board posts from the live database. Report and sanction records and a record of the deletion (account number and deletion time, used to confirm the deletion and handle disputes) are kept for 1 year, email inquiries for 1 year after handling and access logs for 3 months, and are then deleted. See the "Account Deletion" page for details.
- Daily database backups are deleted automatically after 14 days, and server snapshots after 7 days. Backups are used only for disaster recovery.
- Under the Protection of Communications Secrets Act, we keep access logs (log records and connection-location data: IP address, access date and time) for 3 months, separately from other information.
- Electronic files are deleted so that they cannot be recovered. We do not keep personal information on paper.
3. Provision to Third Parties
We do not provide personal information to third parties, except where a law specifically requires it, for example a request from an investigative agency following legal procedures.
4. Entrustment of Processing (Processors)
| Processor | Entrusted work | Period |
|---|---|---|
| Amazon Web Services Korea LLC | Operating the game server and database (AWS Lightsail, Seoul region); storing backups and snapshots | Until the entrustment contract ends |
5. Overseas Transfer
Personal information on our game server and database is stored in the Republic of Korea (AWS Seoul region, ap-northeast-2) and is not transferred overseas. Information of players who connect from abroad is also processed in Korea.
However, if you email us (thirtyshots2689@outlook.com), your message (your email address and what you write) is kept in an Outlook.com mailbox provided by Microsoft Corporation (USA) and may be stored on Microsoft servers outside Korea. The purpose is answering your inquiry; the transfer happens when the email is received; we keep it for one year after handling and then delete it. If you do not want this, use the in-game account functions (such as account deletion) or avoid including personal information in your email.
6. Rights and Obligations of Data Subjects and Legal Representatives
- You may at any time request access to, correction or deletion of, or suspension of processing of your personal information, and you may withdraw consent.
- You can check or delete it yourself in the in-game "Account" (계정) window or under "My info" (내 정보) on the official homepage, or you can ask us by email from your registered address. A legal representative or a person you authorize may also make a request, together with a power of attorney.
- We tell you the result within 10 days of receiving a request. If we must refuse or limit a request under the law (for example, deleting access logs that another law requires us to keep), we tell you why and how to object.
- You must keep your password safe and must not infringe other people's personal information.
7. Automated Measures
We do not make fully automated decisions that significantly affect your rights or obligations. To keep chat orderly, however, we automatically mask some profanity in World and General chat and in whispers, and we block your chat for 60 minutes when three different players report you within one day (only the number of reporting players is considered). If you ask for an explanation or object by email, a person will review the case again.
8. Children Under 14
Children under 14 cannot sign up, and we ask you to confirm that you are 14 or older when you sign up. If we learn that we have collected information from a child under 14, we delete the account and the information immediately. A legal representative can request deletion by email.
9. Security Measures
- Passwords are stored only as salted hashes and are not kept on your device.
- All traffic is encrypted with TLS (HTTPS and WSS).
- Servers can be administered only with SSH keys; administration screens are not exposed to the internet; a firewall allows only the necessary connections.
- Server security updates are applied automatically, and request rate limits prevent abuse.
- Access to personal information is limited to the operator.
- Data is backed up daily, and backups are deleted automatically after the set period. The servers are protected by the physical security of AWS data centers.
10. Automatic Collection Tools (Cookies, etc.)
- The official homepage keeps you logged in by storing login information in your browser's session storage. It is cleared when you close the browser tab.
- We use no advertising or analytics cookies or behavioral-tracking tools, and we do not show targeted advertising.
- The game app stores login information and the device identifier on your device for automatic login.
- How to refuse: you can block site data in your browser settings, but you may then be unable to log in to the homepage. In the game, logging out turns off automatic login.
11. Privacy Officer
- Contact: Aurel Studio Privacy Officer ("Aurel Studio 개인정보 보호 담당")
- Email: thirtyshots2689@outlook.com
Please use this contact for privacy questions, access requests, complaints and remedies.
12. Remedies for Infringement of Rights (Korea)
For counseling or dispute mediation about privacy infringements, you can contact the following Korean agencies (the numbers are dialed without an area code from within Korea):
- Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr
- Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
- Supreme Prosecutors' Office: 1301, www.spo.go.kr
- Korean National Police Agency: 182, ecrm.police.go.kr
13. Changes to This Policy
If we change this Policy, we announce it in the game and on the official homepage 7 days before the change takes effect (30 days for important changes).
- Version 1.0: effective October 4, 2026
14. Additional Information for Players in the EEA, the UK and Elsewhere (GDPR)
- Controller: Aurel Studio, thirtyshots2689@outlook.com.
- Legal bases (Article 6(1) GDPR):
- (b) performance of our contract with you: sign-up and login, automatic login, game data, cloud save and save history, chat relay, friends and block lists, board posts and support emails;
- (f) our legitimate interests in keeping the game fair and secure, restoring lost items, resolving disputes and balancing the game: item and currency log, open-beta statistics, reports and sanctions, access logs;
- (c) legal obligations: where Korean law requires us to keep records, such as access logs.
- Your rights: you have the right to access, rectify and erase your data, to restrict processing, to object to processing (in particular processing based on legitimate interests) and to data portability; on request, we will send you a copy of your account data in a common machine-readable format. You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We make no such decisions, and a person will review the automatic 60-minute chat block on request. You may also lodge a complaint with the data protection authority in the country where you live or work.
- How to exercise your rights: email us from your registered address. We respond within 10 days where possible and in any case within one month.
- International transfers: your data is stored and processed in the Republic of Korea. The European Commission adopted an adequacy decision for the Republic of Korea on 17 December 2021, and the United Kingdom has also recognized Korea as providing adequate protection (2022), so data may be transferred from the EEA and the UK to Korea without additional safeguards.
- Retention: see Sections 1 and 2.
- Children: you must be at least 14 years old. If the law of your country sets a higher minimum age for online services or requires parental consent, you must meet that requirement.
- No sale and no targeted advertising: we do not sell your personal information or share it for cross-context behavioral advertising.