Privacy Policy

1. Business Operator Information

Nancale (hereinafter "the Service") complies with the Act on the Protection of Personal Information and other applicable laws, regulations, and guidelines, and handles users' personal information appropriately.

For inquiries regarding the operator, please contact the inquiry desk listed at the end of this Policy.

2. Information We Collect

• Account information: email address, display name, password (stored hashed)
• Google login information: email address, display name, profile image URL, and Google ID of the Google account
• Service usage information: prediction history, point balance, favorite teams and leagues, personal events on the calendar, and group participation information
• Push notification subscription information: notification endpoint, Expo / APNs / FCM device tokens, encryption keys, and notification settings
• Access logs: IP address, user agent, access date and time, referrer, etc.
• Cookies and device identification information (see Section 7 below)
• Information used to verify friend invitations: an identifier the app creates for each device (install ID), invite codes, the time the "Install" button was pressed on the invite page, a hashed value of the IP address, and a hashed value of the Android device identifier (Android ID)
• Clipboard contents (iPhone app only): pressing "Install" on the invite page copies the invite link to the clipboard. When someone who installed the app from an invite link opens it for the first time, the app reads the clipboard once, with permission through the iPhone prompt. It is used as an invite code only if it is an invite link; any other content is neither stored nor sent

3. Purposes of Use

• Provision, operation, and maintenance of the Service
• User authentication, point management, and recording and aggregation of prediction history
• Delivery of push notifications
• Sending emails for customer support such as password resets
• Analysis of usage, improvement of the Service, and development of new features
• Detection and prevention of fraudulent use
• Delivery of advertisements (see Section 5 below)
• Determining whether a friend invitation succeeded, and expanding the inviter's favorites limit

4. Retention Period

• Account information, prediction history, etc.: for the period the account remains active. After account deletion, data is promptly removed from the database (deletion from backups may take up to 30 days).
• Access logs: retained for up to 90 days and then deleted sequentially.
• Information whose retention is required by law: for the statutory retention period
• Hashed IP addresses used for friend invitations: kept for up to 3 days, then erased. Install IDs and invitation records: kept while the Service is provided, to verify invitations and prevent abuse

5. Google AdSense (Advertising)

The Service uses Google AdSense. Google uses cookies and similar technologies stored in the user's browser to deliver advertisements based on past access information. The use of advertising cookies by Google can be disabled from the Ad Settings page.

Details: Google Advertising Policies

6. Google Analytics

The Service uses Google Analytics (GA4) for access analysis. Google Analytics uses cookies to collect anonymous traffic data. The information collected does not include personally identifiable information.

You can opt out using a browser add-on: Google Analytics Opt-out

Details: Google Privacy Policy

7. Cookies and External Transmission

The Service uses the following cookies and similar technologies. In accordance with the external transmission rules set forth in Article 27-12 of the Telecommunications Business Act, we disclose the content of the transmitted information, its recipients, and the purposes of use.

8. Provision to Third Parties and Subcontractors

The Service does not provide personal information to third parties except as required by law or with the consent of the individual. However, it entrusts the handling of personal information to the following subcontractors to the extent necessary to achieve the purposes of use.

• Cloudflare, Inc. (USA): hosting, database, CDN
• Google LLC (USA): authentication, access analysis, ad delivery
• Resend, Inc. (USA): email delivery
• API-SPORTS SAS (France), Sportmonks B.V. (Netherlands): acquisition of sports data (no personal information is transmitted)
• 650 Industries, Inc. (Expo) (USA): push notification delivery for iOS/Android apps
• Apple Inc. (USA): distribution of the iOS app and delivery of notifications via APNs (Apple Push Notification service)

9. Provision to Third Parties Located Overseas

The provision of personal data to the subcontractors above constitutes provision to third parties located overseas. Information on the personal data protection systems of each country can be found on the website of the Personal Information Protection Commission. All subcontractors implement security control measures equivalent to GDPR, CCPA, and other international standards.

10. Security Control Measures

• Encryption of communications (HTTPS)
• One-way hashed storage of passwords (PBKDF2-SHA256)
• Minimization of access privileges
• Regular system monitoring

11. Requests for Disclosure, etc. of Retained Personal Data

Under the Act on the Protection of Personal Information, users may request the disclosure, correction, addition, deletion, suspension of use, or suspension of provision to third parties of their own personal data held by the Service. To make a request, please contact the inquiry desk listed at the end of this Policy.

You may also delete your retained data yourself using the account deletion feature of the Service (within the settings screen).

12. Use by Minors

The Service is intended for persons aged 18 and over. Persons under 18 may not use the Service. For persons under 14, the consent of a person with parental authority is required.

13. Inquiry Desk

For inquiries regarding the handling of personal information and requests for disclosure, etc., please contact us using the inquiry form below.

Inquiry Form

14. Revisions

This Policy may be revised as necessary in connection with changes in laws and regulations or changes to the Service. In the event of any material change, we will provide notice on the Service.