This policy explains what information Webinstudio ("we") handles in The Real Killer mobile app (the "app") and on its official website (https:/
localStorage in the web demo (/play/). We never send them to our server (sections 3 and 10).gtag.js) to measure aggregate visitor traffic and Google AdSense (Google LLC) to display advertisements on introduction and guide pages (never inside the /play/ web game screen). Third-party vendors, including Google, use cookies to serve ads based on prior visits to this website or other websites, and you can opt out of personalized advertising at any time (section 10).| Information | When we get it | Why | When it is deleted |
|---|---|---|---|
| Anonymous account ID (a random UUID) and sign-in token | Automatically, the first time the app downloads the case list or a case from our server | To unlock the cases you bought on this account, and to restore your purchases on another phone | When you ask us to delete it, or when the app hasn't connected to our server for 12 months |
| Purchase records: the product you bought and the cases it unlocked, store name, store transaction ID, payment environment (real or test purchase), and the times of purchase, verification, and refund | When you buy a case or tap "Restore Purchases" | To unlock the cases you bought, lock them again if a purchase is refunded, and restore purchases | When you delete your account, we remove the link between these records and the account. The transaction records themselves are kept for the periods in section 8, to handle refunds and meet legal requirements |
| Server logs: IP address, request time, request details, and request headers that include app and device information | Automatically, by Supabase, whenever the app talks to our server | To prevent security incidents and find the cause of outages | After 1 day |
| Sign-in records: anonymous account ID, IP address, time, and the action, such as creating the account, signing in, or renewing a sign-in | Automatically, by Supabase, when the app creates your account or signs in | To investigate account takeovers and abuse | After 30 days |
We never receive card numbers or bank details. Apple's App Store and Google Play handle payment. We only check that a purchase is genuine (section 5).
The following stays on your phone and is never sent to our server. It is removed when you uninstall the app.
The app reads your phone's language setting to choose a starting language. When it downloads a case, it tells the server which language you picked so it receives the case in that language. We don't store your language on the server. The app also reads your phone's clock to choose the day or night picture on the Home screen, and that isn't sent either.
The app doesn't use your location, contacts, photos, camera, or microphone, so it never asks you for access permissions, required or optional. It only uses the ordinary permissions needed to play music, vibrate, keep the screen on, and make in-app purchases.
We use the company below to run our server and database. It handles your information only on our instructions.
| Provider | Supabase Pte. Ltd. (Singapore), privacy contact privacy@supabase.com |
| Where data is stored | Amazon Web Services data centers in Seoul, South Korea (ap-northeast-2) |
| What is transferred | Everything listed in section 2 |
| When and how | Each time the app connects to our server, over an encrypted connection (HTTPS) |
| Purpose | Downloading cases, verifying purchases, and running the app's server |
| How long | The periods in section 2 |
| How to refuse | Play only the case that comes with the app, and don't download or buy cases from our server. You can also ask for deletion as described in section 7. Without this transfer, you can't download or buy new cases |
Because the server may be outside your country, your information may be processed in a country with different data protection laws. Supabase's data processing terms include the European Commission's standard contractual clauses for transfers out of Europe.
When you buy a case or restore purchases, we pass the information below to the store you use so we can confirm the payment.
| Recipient | Apple Inc. (United States) on iPhone, or Google LLC (United States) on Android. Each company's privacy policy lists its privacy contact (www.apple.com/legal/privacy, policies.google.com/privacy) |
| Legal basis | Performing our contract with you, which includes confirming and restoring the cases you buy |
| Destination country | United States |
| What is transferred | Your anonymous account ID (attached to the payment request) and the Google purchase token (when our server checks the purchase with Google) |
| When and how | When you pay or restore purchases, over an encrypted connection (HTTPS) |
| Purpose | Confirming that the payment is genuine, restoring purchases, and handling refunds |
| How long | Set by each company's privacy policy |
| How to refuse | If you don't buy cases, nothing is transferred. You can play the free first case without this transfer |
When we verify a purchase made on Google Play, our server sends the product ID and purchase token to Google (Google Play Developer API) to check that the purchase is genuine. For App Store purchases, Apple signs the transaction information it gives your phone, and our server checks that signature against Apple's certificates. Our server doesn't send this transaction information back to Apple. When you buy a case, the app attaches your anonymous account ID to the payment request it sends to Apple or Google. Payment information is governed by each company's own privacy policy.
We build the app with Expo (EAS). Expo is a build tool, and the app doesn't send your information to Expo when it runs.
The server deletes information automatically when its retention period ends. Information deleted from the database can't be recovered.
To protect against server failure, we make a copy of the database (including anonymous account IDs and purchase records) once a week and keep it only on the operator's computer. Each time we make a new copy, we delete copies older than 4 weeks, so deleted information can remain in these copies for up to 5 weeks. We use these copies only to restore the server if it breaks.
You can ask us at any time to show you your information, correct it, delete it, or stop processing it.
We handle requests within 10 days and let you know the result. If the law requires us to keep some of the information, we'll tell you why and keep it separately for the required period.
Under Korea's Act on the Consumer Protection in Electronic Commerce, we keep records of case sales for these periods:
We don't use these records for any other purpose.
The mobile app (iOS and Android) doesn't use cookies, mobile advertising IDs (IDFA or AAID), in-app ads, or analytics tools.
On our official website (https:/
localStorage): When you play Case 1 in the browser (https://jinbeom.web.app/play/), your saved progress, Case Log, and language or audio settings are stored only in your browser's localStorage and are never sent to our server. No advertisements are served inside the /play/ web game screen.gtag.js), provided by Google LLC, to measure aggregate visitor traffic and page usage. Google Analytics uses cookies to collect anonymized statistical visit data without collecting your name or email address.https://jinbeom.web.app use Google AdSense (Google LLC) to display advertisements.jinbeom.web.app and/or other sites on the Internet.The app is for people aged 15 and over, because it's a murder investigation game. Our server holds nothing that reveals your age, but if we learn we have stored information from a child under 15 (or under 13 in the United States), we delete it right away. Parents and guardians can ask for deletion as described in section 7.
If you need help with a privacy violation, you can also contact these Korean authorities:
In the mobile app, we don't sell personal information or share it for cross-context behavioral advertising, and we don't use sensitive personal information (for cookies, Google Analytics, and opting out of Google AdSense personalized advertising on our official website, see section 10). In the last 12 months we collected the categories in section 2: identifiers (anonymous account ID, IP address) and commercial information (purchase records). We disclose them to our service provider for the purposes listed in section 5, and when you buy a case, we also pass your anonymous account ID to Apple or Google to confirm the payment. You can ask to know, correct, or delete your information as described in section 7, and we won't treat you differently for doing so. The app is not directed to children under 13.
We are the controller of your information. Our legal bases under the GDPR are:
You have the rights of access, rectification, erasure, restriction, objection, and data portability, which you can use as described in section 7. You can also complain to your local data protection authority. In Spain, that is the Agencia Española de Protección de Datos (www.aepd.es).
The operator's name, address, and representative are in section 14. For overseas storage, see section 5. You can ask us to disclose, correct, or stop using your retained personal data as described in section 7.
You can exercise your ARCO rights (access, rectification, cancellation, and opposition) and withdraw your consent as described in section 7.
We announce changes to this policy in the app and on this page 7 days before they take effect, or 30 days before for changes that are worse for you.