Privacy Policy
지구는네모다(GRIDEARTH) Privacy Policy
THEHANDA Inc. (주식회사 더한다)
Effective Date: November 11, 2026 · Business Registration Number: 342-86-03943
This policy outlines the personal information processing standards for the mobile game 지구는네모다(GRIDEARTH) and its PC web version (hereinafter referred to as the “Service”) provided by THEHANDA Inc. (hereinafter referred to as the “Company”). The Company complies with relevant laws and regulations, including the 「Personal Information Protection Act」.
1. Personal Information Items Collected
The Company collects the following information to provide the Service.
| Category | Items | Collection Method |
|---|---|---|
| Membership & Account | Email address (if signed up via email), password (stored with one-way encryption), nickname, unique color, referral code (if entered) | Direct user input |
| Social Login | Kakao·Google·Apple account identifiers and email (if provided by the provider) | Provided by each provider when the user selects social login |
| Identity Verification (Mandatory for members) | (South Korea) Name, mobile phone number, date of birth, gender, Duplication Information (DI) (includes Connecting Information (CI) if provided by the identity verification agency), country of verification / (Overseas) Mobile phone number, verification country, one-way converted value of mobile phone number for duplication prevention | (South Korea) Mobile phone identity verification via identity verification agency (NICE Information Service) / (Overseas) Verification code received via text |
| Photos & Images | Profile photo, images attached to customer inquiries, gallery image submissions (image·source·description) | Camera·photo album access (upon consent) or file selection |
| AI Generation Function Input | Custom character description text·weapon·gender, etc. selections, reference photo (optional), background music mood description (optional), animation motion description (optional), profile background description text and reference image (optional) | Direct user input·upload — Reference photos·images are deleted according to the period in Section 3 |
| User-Generated Content | Generated custom character images·videos·background music, disclosure status and usage price, gift·purchase history | Service usage process |
| Payment & Rewards | In-app purchase history (item, order number, payment time, receipt verification result), offerwall accrual history, gift certificate exchange history (item, order information, recipient mobile phone number) | Google/Apple payment, affiliate accrual notification, service usage process |
| Customer Inquiries | Inquiry type·content·attached images, email address for response (for non-member inquiries) | Direct user input |
| Community (Chat) | Square chat message body, timestamp, author nickname, in-game location (not actual location), report reason·content | Direct user input — Retained only for the duration specified in Section 3 |
| Fortune Telling | Date of birth (identity verification value or value entered directly by the user) | When using the fortune-telling feature |
| Consent to Receive Notifications | Consent status and timestamp for receiving promotional information and nighttime notifications | User selection |
| Automatically Generated·Collected | Device identifier, push notification token, OS·device information, app version, app language·time zone settings, advertising identifier, login records (access time, access IP, device·browser information), game usage records (territory·assets·combat·ranking·clan·RPG progress·story voting·mini-games, etc.), ad viewing history, error·diagnostic records, invite code (if contained in the installation path) | Automatically collected during service usage |
| Device Integrity Token | Firebase App Check token (Play Integrity / App Attest / reCAPTCHA) | Automatically issued by the app·browser — Used to block bots·tampered clients and does not identify individuals |
| Request Rate Limit Value | One-way converted (hashed) value of access IP and request count | Automatically generated upon request — Used only for request rate limiting such as guest account creation |
When using as a guest (non-member), only automatically collected information such as device identifier, push notification token, login records, advertising identifier, and game usage records is processed without email·identity verification information. The Service does not collect or use the user's terminal location information (GPS, etc.), and the in-game location is a virtual location selected by the user on the map.
Information visible to other users: Nickname, identity verification country (flag), character·unique color·profile background, territory·ranking·clan information, character location·health and chat in the Square, and disclosed custom characters along with the creator's nickname·country are visible to other users within the Service. When a clan member is summoned, the clan member's character appears on the screen of other members of the same clan.
2. Purpose of Use of Personal Information
- User identification·authentication, verification of one account per person, account management, and prevention of fraudulent use
- Provision of game services (map·territory·assets·combat·ranking·mailbox·clan·RPG mode·story, etc.) and personalized content (news by country, fortune telling, character example recommendations, regional quests based on verified country, etc.)
- Provision of AI generation features such as custom characters·videos·voice·background music·animation·profile backgrounds
- Sending push notifications, handling customer inquiries (including translation of inquiries·responses)
- Sending promotional information such as events·benefits (only if consent to receive is provided)
- In-app payment·gift certificate issuance processing and settlement
- Ad display (including personalized ads) and reward (offerwall) accrual processing
- Service improvement, statistical analysis, error diagnosis, and fulfillment of legal obligations
- Community (Square chat·public content) operation, automatic masking of prohibited words·contact information, and report processing
- Automatic (AI)·management review of user-generated content and payment of rewards (gold) to creators
- Prevention of fraudulent use such as bot·abusing blocking through device integrity verification, request rate limiting, and reward request verification
3. Retention and Disposal of Personal Information
In principle, the Company shall dispose of personal information without delay once the purpose of its collection and use has been achieved. However, the Company shall retain information for the periods specified below.
- Member Information: Until account deletion. Upon withdrawal, name, mobile phone number, date of birth, gender, personal identification values (CI/DI), and profile email address are deleted immediately. However, to respond to account restoration requests and prevent fraudulent re-registration (re-registration is restricted for 24 hours after withdrawal), the login ID (email), password (encrypted value), mobile phone number, device identifier, social account identifier, nickname, and remaining gold balance at the time of withdrawal shall be separated and stored for 30 days after withdrawal before being disposed of.
- Guest Information: Until conversion to a member or a deletion request is made.
- Game Usage Records: Until account deletion. Notification boxes, mailboxes, game records, etc., are deleted starting from the oldest items once they exceed the set storage limit or period. Even after withdrawal, records related to battles, rankings, and transactions involving other users may remain with user-identifying information such as nicknames removed.
- Reference Photos for Content Creation (Custom Characters): Deleted without delay upon completion of creation. Photos from requests not completed are deleted during the daily cleanup 7 days after the last request, and are deleted immediately upon member withdrawal.
- Profile Background Reference Images: Used for background generation and stored until member withdrawal, after which they are deleted immediately.
- User-Generated Content (Custom Characters, etc.): Until the user ceases public sharing or deletes the content. Content made public before withdrawal may remain visible even after withdrawal with the creator's identity anonymized, and copies purchased or received as gifts by other users will remain in their respective storage.
- E-commerce Related Records: According to relevant laws (e.g., the Act on the Consumer Protection in Electronic Commerce, etc.), 5 years for contracts or subscription withdrawals, 5 years for payment settlements and supply of goods, 3 years for consumer complaints or disputes, and 6 months for display and advertising records. Internal member numbers linked to these records are retained for the same period.
- Customer Inquiry Records: 3 years for records of consumer complaint or dispute handling.
- Login Records and Connection Logs: 3 months in accordance with the Protection of Communications Secrets Act.
- Chat Content: 24 hours after creation for real-time delivery and server restart preparation.
- Chat Reporting Records (including the content of reported messages): 180 days from the date of the report.
- Chat Restriction Records: 1 year from the date the restriction ends. Other reporting and disciplinary records (content removal, account suspension): 1 year.
- Request Frequency Limit Values (IP Hash): Sequentially deleted after the limit period (maximum 1 day) expires.
Disposal Procedure: Personal information for which the retention period has expired or the purpose of processing has been achieved shall be destroyed without delay. Information preserved in accordance with relevant laws and information for the restoration of withdrawn members is stored separately from other information and is not used for purposes other than retention.
Disposal Method: Information stored in electronic files and databases is deleted in a manner that prevents recovery or is processed so that the user cannot be identified. Information printed on paper is shredded or incinerated.
4. Provision of Personal Information to Third Parties
In principle, the Company does not provide users' personal information to external parties, except in the following cases:
- When the user has provided prior consent.
- When required by law or upon a lawful request by investigative agencies.
- For social login and identity verification, necessary information is exchanged during the authentication process with each provider (Kakao, Google, Apple, NICE Information Service).
Information collected directly by advertising operators via advertising SDKs is described in Section 6.
5. Entrustment of Personal Information Processing
To provide seamless services, the Company entrusts the following tasks:
| Entrustee | Entrusted Task |
|---|---|
| Amazon Web Services | Infrastructure operation including servers, databases, file storage, search, and content delivery (CDN) |
| Google (Firebase / Google Cloud) | Database, authentication, push notifications, server functions, and web hosting |
| Google (Firebase App Check, reCAPTCHA Enterprise) | Device and browser integrity verification (bot blocking) |
| Google (Generative AI — Gemini API) | Custom character image and background music generation (descriptive text and reference photos), automatic safety review of generation requests, drafting of movement sentences for character videos, and translation of customer inquiries/responses (Used as a paid API, with the condition that transmitted content is not used for Google's model training) |
| Alibaba Cloud (Model Studio) | Custom character video generation (generated character images and movement sentences) |
| ElevenLabs | Custom character voice generation (AI-written character dialogue and tone descriptions) |
| BytePlus (ModelArk) | Character animation generation (generated character images and user-inputted movement descriptions), profile background image generation (user-inputted descriptive text and reference images) |
| Google AdMob · Google AdSense | Advertisement delivery and performance measurement (connected ad networks are in Section 6) |
| AppsFlyer | Advertising performance measurement (app installation and ad attribution analysis). Runs when the app is opened; on iOS, it also receives copies of Apple SKAdNetwork conversion reports (no user identification information) |
| SnapPlay | Reward offerwall credit processing |
| MyChips | Reward offerwall credit processing |
| GiftishowBiz | Issuance of gift vouchers (Gifticons) and SMS delivery |
| NICE Information Service | Mobile phone identity verification |
| Naver Cloud | SMS delivery for overseas mobile phone authentication codes |
| AhaSend | Sending authentication and informational emails |
The Company stipulates the prohibition of use for purposes other than the entrusted tasks and safe processing in outsourcing agreements (including each company's data processing terms), and monitors whether the outsourcee processes personal information securely. If an outsourcee or entrusted task changes, we will notify you through this policy.
International Transfer of Personal Information
For the purpose of providing services (performance of contract), the Company transfers (entrusts for processing/stores) personal information overseas as follows. Transfers occur via an encrypted network when using the service.
- Amazon Web Services, Inc. (USA, primary storage location: Seoul Region) — Server/database/file storage / Transferred items: Service operation information such as account and game usage history / Time of transfer: Frequently when using the service / Retention period: Period specified in Section 3 / Contact: aws-korea-privacy@amazon.com
- Google LLC (USA, etc., countries where Google data centers are located) — Firebase database/authentication/push/server functions/web hosting, Google AdMob · Google AdSense ad serving, Firebase App Check/reCAPTCHA integrity verification, Gemini API (character image/background music generation, automated safety review, text generation for videos, translation of inquiries and responses) / Transferred items: Device identifier, push token, advertising identifier, game usage history, device integrity token, Gemini transmission content (character description text, reference photos, background music mood descriptions, user inquiries and responses) / Time of transfer: Frequently when using the service / Retention period: Until the purpose of entrustment is achieved / Contact: https://support.google.com/policies
- Alibaba Cloud (Singapore) Private Limited (Singapore) — Custom character video generation / Transferred items: Generated character image, action text (no member identification information) / Time of transfer: Upon video generation / Retention period: Until generation is complete / Contact: DPO_Intl@alibabacloud.com
- Eleven Labs Inc. (USA) — Custom character voice generation / Transferred items: Character dialogue written by AI (based on character names and descriptions entered by the user), voice tone descriptions (no member identification information) / Time of transfer: When generating voice after character completion / Retention period: Until generation is complete / Contact: dpo@elevenlabs.io
- BytePlus Pte. Ltd. (Singapore) — Character animation/profile background image generation / Transferred items: Generated character image, text created from action descriptions entered by the user, profile background description text, and reference images / Time of transfer: Upon generation request / Retention period: Until generation is complete / Contact: https://www.byteplus.com/en/legal/privacy-policy
- AhaSend B.V. (Netherlands) — Sending authentication/information emails / Transferred items: Email address, mail content (authentication codes, etc.) / Time of transfer: When sending emails / Retention period: Until the purpose of sending is achieved / Contact: https://ahasend.com/privacy
- Advertising Partners — Meta Platforms, Inc. (USA, https://www.facebook.com/privacy/policy) · Bytedance Pte. Ltd. (Pangle, Singapore, pangle_support@bytedance.com) · Unity Technologies SF (USA, DPO@unity3d.com) · Liftoff Mobile, Inc. (USA, https://liftoff.ai/privacy-policy) — Ad serving and performance measurement / Transferred items: Advertising identifier, device information, ad usage history, approximate location estimated based on access IP / Time of transfer: Upon ad request / Retention period: In accordance with each company's privacy policy
- AppsFlyer Ltd. (Israel) — Advertising performance measurement / Transferred items: Member number, advertising identifier (if permitted), device information, app installation and usage events, and in the case of iOS, copies of Apple SKAdNetwork conversion reports (no user identification information) / Time of transfer: Upon app installation/usage / Retention period: In accordance with each company's privacy policy / Contact: privacy@appsflyer.com
- MyChips s.r.l. (Italy, Viale Marconi 16, 40026 Imola) — Provision of reward offerwall (partner game 1) · processing of reward accrual / Transferred items: Internal member identification value · device OS version · advertising identifier (if permitted) · accrual results / Time of transfer: When the offerwall is opened and when the accrual is confirmed / Retention period: Until accrual · settlement verification is completed (in accordance with each company's privacy policy) / Contact: info@mychips.io
If you do not wish for international transfer: Users may refuse the international transfer of their personal information. However, as the aforementioned transfers are necessary for service provision, refusal may make it difficult to use the service; in such cases, you may stop processing by withdrawing your membership or by making a request to our Customer Center (help@gridearth.app). You may refuse the use of reference photos for custom characters via the consent window that appears upon initial attachment; if refused, you may create characters using text only. If you do not attach reference images for profile backgrounds, they will not be transmitted. Personalized advertising can be restricted using the methods described in Section 6.
6. Advertising Identifiers and Automated Collection Tools
- The service may use advertising identifiers (Android Advertising ID / Apple IDFA) for ad serving and reward accrual. On iOS, tracking identifiers are used only if permitted via App Tracking Transparency (ATT).
- For ad serving and performance measurement, the service may collect and use advertising identifiers, device information, ad usage history, and approximate locations estimated based on access IP through the following advertising partners: Google AdMob, Meta Audience Network, Pangle, Unity Ads, and Liftoff (Vungle). This information may be used to display advertisements tailored to the user's interests (personalized advertising), and the retention period follows each company's policy.
- If you do not wish to receive personalized advertising, you can delete or reset your Advertising ID in the 'Ads' menu of your Android device settings, or turn off 'Allow Apps to Request to Track' in iOS under 'Settings > Privacy & Security > Tracking'. Users in regions requiring consent, such as Europe, may re-select their personalized advertising consent in 'Privacy Options' within the app settings.
- When opening the Offerwall, the user's internal membership identification value and nickname are transmitted to SnapPlay, and the internal membership identification value, device OS version, and advertising identifier are transmitted to MyChips; affiliate SDKs may collect advertising identifiers, etc.
- When using the map screen, place search, and certain video playback features, the user's device connects directly to external map, search, and video providers (OpenStreetMap Nominatim, Komoot Photon, OpenFreeMap, Esri, Amazon terrain tiles, YouTube). In such cases, general access information such as search queries, the map area being viewed, and access IP may be transmitted to those providers. The Company does not provide member information to these entities.
- The PC web version uses browser storage (local storage, etc.) to maintain logins and save settings, and reCAPTCHA, which prevents fraudulent use, may use cookies. You may clear stored information or block cookies through your browser settings, but please note that this may make certain features, such as logging in, difficult to use.
- The PC web version may show ads through Google AdSense. Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites. If you do not want personalized ads, you can turn them off in Google's ad settings (https://myadcenter.google.com) or opt out of third-party vendors' personalized-ad cookies at https://www.aboutads.info. Users in the European Economic Area, the United Kingdom and Switzerland are asked for consent to ad cookies through a Google-certified consent management tool and can change this choice at any time. How Google uses information: https://policies.google.com/technologies/partner-sites
7. Rights of Users and Methods of Exercise
- Users may request access to, correction of, deletion of, or suspension of processing of their personal information and withdraw their consent at any time.
- Users can directly modify information such as nicknames, configure notification and advertising information reception settings, access 'Privacy Options' (for Europe, etc.), and delete their accounts within the app settings. Other requests may be sent to the contact information below (help@gridearth.app). Guest users may request deletion via email. The Company will notify the user of the processing results within 10 days of receiving the request.
- Rights may be exercised through a legal representative or an authorized agent, in which case a power of attorney must be submitted.
- Information required to be retained by law may be stored for the period specified in Section 3, even if a request for deletion is made.
- Permissions (camera, photos, notifications) can be revoked individually through device settings.
- Automated Decision-Making: The Company performs the following processes automatically without human intervention: masking prohibited words and contact information in square chats and limiting spam, masking chats reported by two or more different users, restricting 24-hour chat access for users reported by 3 or more people within 24 hours, automatically making public content reported by 3 or more people private, refusing generation based on AI service safety standards, and server verification of reward requests. Users may request an explanation or a review by the management team regarding these decisions, and the Company will have the management team review and notify the user of the result, unless there is a justifiable reason not to do so.
8. Children Under the Age of 14
The service is available only to those aged 14 or older, and the Company verifies age at the registration and guest initiation stages. The Company does not collect personal information from children under 14, and if it discovers that a child under 14 has registered, it will terminate the use of said account and delete the personal information without delay.
9. Measures to Ensure the Security of Personal Information
- Administrative Measures: Limiting personnel with access to personal information to a minimum, protecting the administrator screen with two-factor authentication, and maintaining logs of activities performed on the administrator screen.
- Technical Measures: One-way encryption of passwords, encryption of transmission sections (HTTPS), management of server and database access rights, blocking unauthorized access through device integrity verification and request rate limiting, and blocking external access to private files such as reference photos.
- Physical Measures: Personal information is stored in secure data centers operated by cloud service providers (AWS, Google).
10. Privacy Officer and Redress for Infringement of Rights
For inquiries, complaints, or damage relief regarding the processing of personal information, please contact us below, and we will respond and handle the matter without delay.
- Privacy Officer Chul-woong Choi (CEO)
- Company THEHANDA Inc. (주식회사 더한다)
- Email help@gridearth.app
- Phone 010-6614-9391 (+82-10-6614-9391)
- Address 354, Gangnam-daero, Gangnam-gu, Seoul, 11-967
If you require reporting or consultation regarding personal information infringement, you may contact the following agencies:
- Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
- Personal Information Infringement Report Center (Korea Internet & Security Agency): privacy.kisa.or.kr / 118 (no area code)
- Supreme Prosecutors' Office: www.spo.go.kr / 1301 (no area code)
- Korean National Police Agency: ecrm.police.go.kr / 182 (no area code)
11. Duty of Notification
In the event of any additions, deletions, or modifications to this policy, the Company will provide notification through the service at least 7 days prior to implementation.
Revised November 1, 2026 — Supplemented items include: categories of collection (mandatory identity verification for members, overseas SMS authentication, AI generation input, photos and inquiries, login logs, fortune-telling, notification consent, etc.), information visible to other users, purpose of use, retention period and destruction procedures/methods, consignment (expansion of Gemini purpose, addition of Alibaba Cloud, BytePlus, ElevenLabs, AppsFlyer, SnapPlay, Naver Cloud, AhaSend), overseas transfer (correction of AhaSend's country of origin, addition of Alibaba Cloud, BytePlus, ElevenLabs, AppsFlyer, advertising partners, and opt-out methods), advertising partners and personalized advertising, external map and search services, automated decision-making, children under 14, security measures, and the Privacy Officer and methods for redressing infringement of rights. This is an amendment to the draft previously announced for implementation on November 22, 2026. Information on PC web ads (Google AdSense) and advertising cookies has also been added.
Addendum This Privacy Policy shall be effective as of November 11, 2026. This revision corrects when AppsFlyer runs and the items transferred to it. The previous policy (effective November 1, 2026) is available upon request.