Privacy Policy
This English version is provided for convenience. If it differs from the Korean original, the Korean version prevails: Korean original (한국어 원문).
What we collect
| When | What |
|---|---|
| Signing up for a Somnia account | Email and password (stored as a one-way hash that cannot be reversed) |
| Social sign-in (Google, Apple, Facebook, NAVER, LINE) | The provider's unique user identifier and, if the provider shares it, your email |
| Consent at sign-up | Terms version, time of consent, confirmation that you are 14 or older, whether you opted in to night-time promotional notifications |
| Automatically while you play | Game UID, app install identifier, access logs and IP address, gameplay records, store transaction IDs |
| Notifications (when you open the app and sign in) | Push notification token, app language, whether you opted in to event and offer (promotional) notifications |
| Support requests | Your message, app version and device type, our replies |
| Watching an ad for a reward (only when you watch one) | Ad transaction ID, time watched and the reward received (checked against your game UID). Ads are shown by Google AdMob; what Google receives directly is described under Ads |
| App errors and crashes (automatically) | Crash logs, device model, OS version, app version and a crash-reporting installation identifier (your account ID is not sent) |
We do not collect your name, birth date, gender, phone number or profile photo. Children under 14 cannot sign up.
Why we use it
Sign-in and account identification, account recovery and support, purchase verification and refunds, preventing abuse, and operating and improving the game.
How long we keep it
When you request account deletion in the app, your account and game data (heroes, currencies, progress, friends, Lantern Circle and so on) are deleted after 7 days. Signing in again within that time cancels the request. The records below are kept for a set period, as required by law or to prevent abuse, and then deleted.
| Record | Kept for | Why |
|---|---|---|
| Purchase records (store transaction ID, product, amount, refunds) | 5 years | Korean e-commerce law (records of payment and supply of goods). Stored separately from the account |
| Summon records and currency change records | 5 years | Handling disputes over purchases and gacha items. Stored unlinked from the account |
| Support requests and replies | 3 years | Korean e-commerce law (records of consumer complaints and dispute handling) |
| Gameplay records and access logs (including IP addresses) | 1 year from when they were recorded | Preventing abuse and handling disputes; the Korean Protection of Communications Secrets Act (access logs for at least 3 months). After 90 days, records are removed from the game database and moved to private archive storage (Cloudflare R2) until the year is up. Records already moved stay until the year is up even if you delete your account |
| Chat messages | 30 days (180 days if reported) | Handling reports and checking policy violations. If you delete your account, the author is shown as "Departed Traveler" |
| Push notification tokens | Until you sign out or delete your account | Sending notifications. If a token stops working because the app was removed, it is deleted the next time we send a notification |
| App error and crash reports | 90 days | Finding and fixing the causes of app errors (stored in Firebase Crashlytics) |
| App usage analytics | 2 months | Seeing at which step players stop playing and measuring ad performance (stored in Google Analytics for Firebase; aggregated statistics may remain afterwards) |
| Backups | 35 days | Disaster recovery. Data in backups is also deleted when this period ends |
Data whose retention period has ended is deleted from our databases and archives so that it cannot be recovered.
Processors and transfers abroad
We do not sell or share your data with third parties. We entrust processing to the companies below to run the service. Their servers are outside Korea, so your data is transferred to those countries. Transfers take place over encrypted connections while you use the service. When the entrusted work or the contract ends, the company deletes the data.
| Company (contact) | Purpose | Data transferred | Country | Retention |
|---|---|---|---|---|
| Railway Corp. (railway.com) | Running the game servers and database | All data listed under What we collect | Singapore | Same as How long we keep it |
| Cloudflare, Inc. (cloudflare.com) | Backups, archiving usage records older than 90 days, delivering game assets | Backups (all data listed under What we collect), gameplay and access logs | Asia-Pacific (Cloudflare R2) | Backups 35 days; gameplay and access logs 1 year from recording |
| Anthropic, PBC (anthropic.com) | Drafting replies to support requests. A draft is sent as a reply only after an operator has read and edited it | Request text and category, app version and device type, the account's last five requests (opening part only), a summary of recent gameplay records. Email, UID, IP address, device identifiers and sign-in data are removed before sending | USA | While the draft is being made (deleted under the provider's policy; not used for training) |
| Google LLC — Firebase (firebase.google.com) | Push delivery (Firebase Cloud Messaging), hosting this website and the operations console | Push token, notification title and text, website access logs | USA | Until you sign out or delete your account (tokens) |
| Google LLC — Firebase Crashlytics (firebase.google.com) | App error and crash analysis | Crash logs, device model, OS version, app version, Crashlytics installation identifier (your account ID is not sent) | USA | 90 days |
| Google LLC — Google Analytics for Firebase (firebase.google.com) | App usage analysis and ad measurement (reporting install and purchase conversions to Google Ads) | App opens, screen views, tutorial completion, summons, stage clears and purchases (product and amount), device model, OS version, app version, country, Firebase app instance ID, Android advertising ID (the advertising identifier is not used on iPhone and iPad). Your account ID and email are not sent | USA | 2 months |
| Apple Inc. (apple.com) | Push delivery to iPhone and iPad (APNs) | Push token, notification title and text | USA | While the notification is being delivered |
| Resend, Inc. (resend.com) | Sending verification emails | Email address | USA | While the email is being sent |
If you do not want your data transferred abroad: turn off notifications in your device settings and your push token will not be sent (you can still play the game with notifications off). To have a support request answered without an AI draft, email us at the address below instead of using in-app support — an operator answers email requests personally. Transfers to the game servers and backups are essential to provide the service; if you refuse them, you cannot use the service.
Sharing with Apple (optional consent)
Only if, on iPhone or iPad, you tick the optional box in the purchase confirmation ("(Optional) If I request a refund, let Apple know whether this purchase was used to help review it") and then ask Apple for a refund of that purchase, we tell Apple Inc. (USA) whether the purchase was delivered, how much of it was used (the share used) and our preferred outcome (refund or decline). The purpose is Apple's refund review, and Apple keeps the data for as long as it needs for that review (see Apple's privacy policy). Declining has no effect on purchases or play, and if you untick the box in your next purchase confirmation, we stop sending it from then on. You can ask Apple at privacy.apple.com to access or delete the data it received.
Ads (Google AdMob)
Only when you yourself tap "Watch" in Shop › Dream Shards does Google LLC (USA) show you an ad through AdMob. Google then receives directly, in order to serve and measure the ad, your device's advertising identifier (Android advertising ID — on iPhone and iPad we do not ask for tracking permission and do not use the advertising identifier), IP address, device and app information and your interaction with the ad (Google Privacy Policy: policies.google.com/privacy). To verify the reward, we pass Google your game UID and an ad record number, and Google returns only a confirmation that the ad was watched to the end (ad transaction ID). In regions that require consent, such as the EEA and the UK, Google's consent form appears before your first ad, and you can change your choice in the app's Settings. Not watching ads has no effect on the game. On Android you can delete the advertising ID in device Settings › Privacy › Ads.
Notifications
Event and offer (promotional) notifications are sent only if you opted in under Settings › Notifications in the app. Their titles begin with "(광고)" (Korean for "Ad"), and between 9 p.m. and 8 a.m. (KST) they are sent only if you separately opted in to night-time notifications. You can withdraw your consent at any time in the same place.
Your rights
In the app's Settings you can check your linked sign-in methods and delete your account. You can also contact us to access, correct or delete your data or to have its processing suspended. If you remove Somnia Tales from the apps connected in your Facebook settings, we delete the sign-in data we received from Facebook. Users in the EEA, the UK and Switzerland have the additional rights described below.
Contact
Operator: GioniSoft (지오니소프트), CEO 김윤희 (Kim Yunhee) · 20, Seongbok 1-ro 164beon-gil, Suji-gu, Yongin-si, Gyeonggi-do, Republic of Korea (경기도 용인시 수지구 성복1로164번길 20)
Privacy officer: 김윤희 (Kim Yunhee) · Phone +82-10-5343-2869 · Email gionisoft@gmail.com
Users in the EEA, the UK and Switzerland
If the EU General Data Protection Regulation (GDPR), the UK GDPR or the Swiss Federal Act on Data Protection applies to you, this section applies in addition to the rest of this policy.
Controller
GioniSoft (지오니소프트, CEO 김윤희), Republic of Korea. Contact details are under Contact above.
Legal bases
| Purpose | Legal basis |
|---|---|
| Your account and sign-in, saving game progress, verifying and delivering purchases and refunds, friends, Lantern Circles (guilds) and chat, support, service notifications | Performance of our contract with you (Art. 6(1)(b) GDPR). Without this data we cannot provide the game |
| Preventing cheating, fraud and hacking, access logs, app error and crash analysis, backups, support reply drafts (written by AI and reviewed by an operator) | Our legitimate interests (Art. 6(1)(f)) — to run the service securely and reliably and to answer you quickly |
| Keeping the purchase, summon, currency and support records described under How long we keep it | Our legitimate interests (Art. 6(1)(f)) — to comply with the laws that apply to us (such as the Korean e-commerce law) and to handle disputes |
| Event and offer (promotional) notifications and night-time notifications, personalised ads (Google's consent form), sharing refund review information with Apple | Your consent (Art. 6(1)(a)). You can withdraw it at any time; processing carried out before you withdraw remains valid |
Analytics and ads
In these regions, analytics and ad storage in Google Analytics for Firebase are set to "denied" (Google consent mode). Ads appear only when you tap "Watch", and before your first ad, Google's consent form asks whether you agree to personalised ads. You can change your choice at any time in Settings › Ad consent. Google processes the data it receives directly when showing ads as an independent controller (policies.google.com/privacy).
International transfers
We are based in the Republic of Korea, which the European Commission and the UK recognise as providing an adequate level of data protection (adequacy decisions). Transfers to the processors listed above rely on the EU Standard Contractual Clauses (SCCs) in their data processing terms or, where the recipient is certified, on the EU–U.S. Data Privacy Framework.
Your GDPR rights
You can ask to access or get a copy of your data, correct it, erase it, restrict its processing, receive it in a machine-readable format (portability), object to processing based on our legitimate interests, and withdraw your consent. You can delete your account directly in Settings › Account; for any other request, email us at the address under Contact. We reply within one month of verifying your identity (complex requests may take up to two more months, in which case we will tell you why). If you are not satisfied with our reply, you can lodge a complaint with the data protection authority where you live or work, or where you believe an infringement took place.
Automated decisions
We do not make decisions that have legal or similarly significant effects based solely on automated processing. If you receive three warnings in chat within 24 hours, chat is automatically muted for a while; if you contact us, an operator will review it personally.
Age
Children under 14 cannot sign up. If you are under the age of digital consent in your country (13 to 16), please ask a parent or guardian for permission before giving the optional consents (promotional notifications, personalised ads).