Kkugit's Little Expedition

Privacy Policy

Effective date: October 21, 2026

Signing in is optional. Guest progress stays on your device. Signing in lets you save and restore game progress with the same account.

App / developer display name

꾸깃의 작은 탐험단 (Kkugit's Little Expedition)

Scope

Guest progress, game accounts, cloud saves and support for the Android app and its connected web game

Privacy inquiries and your rights

kksshh4848@gmail.com
You may request access, correction, deletion, restriction of processing or account deletion.

1. Guest progress and the age check

Without signing in, the game keeps course progress, scores, gems, unlocked and equipped characters and trails, and settings on your device. Guest progress is not sent to the game save server. The web game uses this site’s browser storage. Guest progress cannot be restored after uninstalling the app, clearing app data or clearing the website’s data.

The age entered in the account panel is converted to a band (under 14, 14–17 or 18 and older), and the input is cleared. The entered age and date of birth are not stored or sent to the server; only the band and confirmation status are kept on this device. Account sign-in, automatic account restoration and cloud saving do not start if the band is under 14 or the check is skipped or incomplete. All courses remain available as a guest.

This feature uses the band the user enters. It is not independent verification of actual age or a parent’s identity. Account features and a parental consent process for users under 14 are not currently provided.

2. Optional sign-in and the data processed

For general users, Google sign-in starts only when selected and creates a game account on the first sign-in. Facebook sign-in and public email registration are not offered. The game does not receive your Google password, Gmail messages or contacts.

Accounts separately invited by the operator for app review can sign in with an email address and password. This method also requires the age-band check and a server-side invitation check. The review password is sent to Supabase Auth for authentication; its plaintext is not stored in game saves, URLs or game screen state. This is not public email registration.

The profile photo URL is part of the basic profile supplied by Google. It is separate from the game’s character artwork; the game has no feature for uploading device photos. The random device identifier is not an Android advertising ID, IMEI or phone number.

Offline progress may remain on the device. Only progress confirmed as saved to the server can be restored with the same account. If device and server saves differ, you choose which to continue; gem balances are not added together automatically.

3. Service providers and processing locations

Authentication and account-based server saves use Supabase. The primary account and game database is configured in Seoul, South Korea (ap-northeast-2). The app also specifies Seoul for function requests such as account deletion. Google processes the Google sign-in authentication you choose.

The Seoul primary database setting does not mean all network processing, access logs, security, support, or operational and recovery copies are confined to South Korea. Those activities may use provider and subprocessor infrastructure. The actual countries for each external log, security record and internal recovery copy, and their detailed erasure timing after individual account deletion, have not been established. A provider’s company location or the Seoul setting alone does not establish those countries or deadlines.

The agreements and subprocessor list below describe the provider’s processing framework. They do not mean every user’s data is transferred to every country in the list.

• Supabase Data Processing Addendum
• Supabase subprocessor list
• Google Privacy Policy

4. Access, security and diagnostic records

Account and server requests generate provider logs that include IP addresses, access times, request paths, user-agent data, authentication actions, request/response status and function execution times. Logs include country, region or city-level location inferred from IP addresses. This is different from precise device location obtained through GPS; the app does not request location permission. These records support authentication auditing, access control, abuse prevention and error/performance checks.

Supabase’s published Free-plan retention criteria are one day for API/database logs and one hour for Auth Audit Logs. These figures do not guarantee that deleting an account simultaneously and permanently erases every separate security, operational or recovery copy. The Free plan does not include customer-facing automatic project backups or PITR; this does not establish that no internal provider recovery copies or separate operator copies exist.

Account/server communication uses HTTPS. Per-user access checks restrict access to other users’ server saves, and server administration secrets are not included in the app. The game does not personalize ads, collect advertising IDs, use third-party ad tracking or sell personal information.

5. Gems and disabled paid-purchase paths

New paid gem sales and ads are currently unavailable. Gems earned through play unlock fixed characters and trails. The game does not directly receive card numbers, banking details or store passwords.

Even with sales disabled, signed-in billing-status requests communicate with the server and may process account identifiers, billing account-binding keys and wallet state. If you explicitly choose purchase restoration, the app queries the Android store for existing purchases. If a relevant purchase is returned, a path sends its store type, product ID and purchase token to the game server for verification. The current server configuration rejects purchase verification and gem crediting for disabled platforms. Disabling sales does not eliminate all billing-related communication.

Billing wallets and linked unlock/equipment data are included in game account deletion. An empty wallet or the existence of a receipt table does not establish that actual payment records exist. Before enabling sales or changing transaction-record retention, we update the information on the store, data, purposes, retention and deletion actually involved.

6. Support email and copies held by the operator

Gmail is the support contact channel. The reply address, message and attachments in support and deletion-request emails are used to respond and perform necessary ownership checks. Email is processed through Google’s mail-service infrastructure. Our operating rule is for the operator to manually check and delete these records within 30 days after the inquiry is closed. This is a manual operating rule for original messages and identified copies under the operator’s control, not a claim that an automatic deletion system is implemented. It does not guarantee that every copy in the email service’s trash, recoverable records or backups is permanently erased within the same 30 days. Do not send unnecessary phone numbers, home addresses, identity documents, passwords or verification codes.

If a specific need such as a security-incident investigation or an unresolved dispute requires longer retention, only the necessary material is kept for the minimum necessary period. We explain the reason, data and period separately. We do not apply an indefinite-retention rule to all inquiries.

Any separately exported user records, downloaded logs or support attachment copies are subject to the same access restrictions, deletion scope and retention rules. If a separate copy is found, it is included in the relevant deletion request. When restoring a copy, our operating rule is to reapply deletion requests already completed. We neither assume that no copies exist nor guarantee automatic cleanup.

7. Account deletion and your rights

In the game, open “Account → Delete account” to start permanent deletion of your game account and server progress. If you have uninstalled the app or cannot access the account screen, use the external deletion guide and the email above. Contacting us from the email linked to your sign-in account helps verify ownership; the same channel is available if you cannot access that email.

Deletion covers the game’s Auth account and basic profile, linked server progress, scores, gems, unlocks, equipment, save revisions/times, random device IDs and linked billing-wallet data. Separately retained provider logs, security records and recovery copies have a different processing scope, subject to the limitations and retention information in this policy.

For email requests, our operating target is completion within seven days after ownership verification. If delayed, we explain the reason and estimated completion date. Deleted game progress cannot be restored. Your Google account itself is not deleted. We do not guarantee immediate removal of caches on other devices or every authentication token already issued.

8. Children, teens and parents

The game can be used by children, teens and adults, and all courses are playable without signing in. Account and cloud features do not start for an under-14 or unconfirmed age band. This restriction does not establish verification of actual age or parental consent.

Parents may use the same contact channel to request access, correction, deletion, restriction of processing or help concerning a child’s records or personal information. We explain the minimum steps needed to verify identity and authority to act. We do not ask for passwords, verification codes or identity documents by email. Before expanding child account features, ads or data transmission, we separately review applicable provider/store conditions and necessary consent/verification steps and update the information.

9. Changes

This policy takes effect on October 21, 2026. We update this document and in-game guidance when data, purposes, services, retention or rights-request procedures change. Material changes are brought to users’ attention.