Privacy Policy

1. Scope

This policy covers the free game Wrath of Cluck (꼬꼬의 분노), provided by 이충헌 (service name: lodado, “we”): its website and the web app you can install to your home screen (PWA). The iOS app has its own app privacy policy; because it shares the same server and accounts, processing common to the iOS app is also described below.

You can optionally sign in with Google or Apple on the website and in the iOS app. A pre-created email/password account can also sign in on the website and in the iOS app. The provider supplies an account identifier and may supply a name, email address or profile information. We do not request phone numbers, precise location or photo uploads. Online features estimate a country from the IP address.

2. Information stored on your device and in cloud save

Your settings are stored in the browser or app storage of the device you play on. Game profile, items and currency are server-authoritative; when you sign in on the website or iOS app, an existing server profile wins. Items and currency earned during offline practice are not saved.

• Game settings (localStorage): graphics, difficulty, accessibility and language. Profile, items and currency are stored in the server-authoritative profile.
• Guest credential: an HttpOnly Secure SameSite cookie on the web, and a separate ThisDeviceOnly Keychain item in the iOS app.
• Graphics quality is device-scoped; difficulty and accessibility settings are account-scoped (or guest-scoped while signed out) in localStorage
• Offline practice data: items and currency earned before server confirmation are not saved to cloud state.
• Cookies for sign-in state and authentication security: used for optional sign-in on the website.
• Device ID and country (chosen country, localStorage): the device ID is device-scoped; the chosen country is account-scoped (or guest-scoped while signed out), and is sent as described in section 4 when you use an online feature.
• Visit count and last visit time (localStorage): only with analytics consent on the website are they turned into ranges such as “first visit” or “2–3 visits” for the statistics in section 3; the values themselves never leave your device.
• Age band (localStorage `henpocalypse:age-band:v2`): when the age question is answered, the birth year you pick is reduced to under 13 / 13 to 15 / 16 and over, and only that band is saved. The birth year itself is not stored or sent to our server (section 8).
• Optional analytics storage: your consent choice is saved on your device. Only after consent does PostHog store a random pseudonymous analytics identifier in cookies and localStorage on the website, and in localStorage only in the iOS app. The analytics SDK may also keep the session-entry page and referrer addresses on your device. It is not linked to game account or device IDs.
• Chosen language: stored in localStorage in the iOS app and in the NEXT_LOCALE cookie on the website to keep the selected route and language in sync.

3. Information processed automatically on the website and web API

The following applies when you use the website or PWA, and when the iOS app uses the web API.

• Hosting (Vercel): delivering the website records your IP address, browser information (User-Agent), the requested address and the time in server logs. They are used to run the service, fix outages and prevent abuse.
• Visit statistics (PostHog, on the Vercel production website and in the iOS app): only on devices answered 16 or older and after analytics consent, page views and game events (game loaded, whether each entry or onboarding step was shown and answered, stage started, won or lost, upgrade, shop and gear choices and similar) are counted and feature flags are provided. PostHog stores a random pseudonymous analytics identifier in cookies and localStorage (localStorage only in the iOS app) and keeps a per-device pseudonymous analytics profile for that identifier to analyze return visits, retention and gameplay flow. We do not send or link game account or device IDs. Autocapture is limited to clicks on explicitly marked safe analytics buttons, without collecting text or input values. Surveys and session recording are disabled. Browser, operating system, device type, screen size, language, referrer and the visit range from section 2 may be recorded. URL queries and fragments are removed from page and referrer addresses before transmission.
• Visit statistics (Vercel Analytics): independently of PostHog analytics consent, pageviews and game events are counted on the Vercel production website, along with game events from the iOS app. Game events are sent through the shared telemetry custom-event sink, without game account or device IDs. Entry and onboarding step events carry only the step name and whether it was answered (answered, skipped, accepted, rejected; a tour reports the step number it ended on), never a birth year or age band. The iOS app's game events are relayed to Vercel Analytics through the web API, and the IP address and User-Agent of that request are used to count visitors. URLs are sanitized before transmission by removing queries and fragments. Vercel Analytics is not controlled by acceptance, rejection or withdrawal in the analytics banner or Analytics settings in the game’s Settings tab. PostHog does not collect new analytics before consent or after rejection or withdrawal. Both services are disabled in local and preview builds. The banner and Analytics settings in the game’s Settings tab control PostHog consent only.
• Error diagnostics (Sentry, United States): operational errors from the website, the web API used by the iOS app and the iOS app itself are sent. The website and web API send them only on an explicitly enabled Vercel production deployment, and the iOS app only from release builds of the iOS app with error diagnostics turned on. The error information sent to Sentry contains only the error type, safe generated-bundle path, enumerated operation label and enumerated error code, plus the iOS app’s version for app errors. Error messages, user identifiers, request headers, cookies, bodies, query values and profile data are excluded. Network metadata such as the connection IP address and User-Agent may be processed separately by Sentry and the hosting provider. Replay, tracing, profiling and Logs are disabled. Local, test and preview deployments and development app builds remain disabled.
• Game models, sounds and fonts are served by this website itself; no other service is contacted for them.

4. Information the online features send

On the website and iOS app, the game may automatically request lobby ranking, faction and country information at game start; the signed-in web or iOS client may read cloud-save state. The information below is sent when you use an online feature. Run records, votes and shared links go through the website's server to Supabase, and these requests are also recorded in the hosting logs described in section 3 (IP address, User-Agent and so on). Run records, votes and shared links contain no name or contact details; optional sign-in is processed separately as described below.

• Device ID: a random value created on your device (localStorage) the first time you use an online feature, used to group a device's records and, when signed in, link the device to your game account.
• Campaign recovery: the admitted run summary includes whether the optional recovery objective was completed. The server stores per-stage first recovery and credit settlement in the profile. Camp and story display confirmed gameplay progress, not real-world location.
• Guest server storage: before sign-in, the server stores a guest identifier and credential hash. Game profiles, items and currency, run admission and result records, command identifiers and processing receipts support saving, verification and duplicate-reward prevention. Signing in also records the account binding and consumption time of the guest credential.
• Official daily horde run record: the device ID, a country, survival time, kills, stage, equipment, selected upgrades and other values needed for run results and reward eligibility. The country is estimated from the request IP; your chosen country (or browser-language country when none was chosen) is used only when estimation is unavailable. It feeds the daily ranking, weekly country war and limited-reward eligibility.
• Weekly faction vote: the device ID and the chosen faction (once a week).
• Raid records: using the raid API processes event and account identifiers, device ID and country, and run date, performs replay verification, and records verified damage, survival time, win status and a run hash for deduplication. Crown receipts are stored per account and event; account deletion or expiry removes the receipt and crown ownership and clears the user_id link from retained damage records. Recent records remain until their own expiry and a device ID remains, so this is not full anonymization.
• Shared link: pressing Send run or Send wave stores that run record or wave behind a short shared link.
• Sign in with Google (website and iOS, optional): once you sign in, a player ID made from the account number Google provides (starting with google:) is stored in Supabase with the server-authoritative profile, the links between this account and the device IDs you signed in on, and your reward claims. The name, email and profile picture Google provides are processed for authentication and the session but are not stored in the database. Delete account in the settings clears the account user_id links, cloud save, device links and reward claims, but does not erase separate daily, vote or shared records or guest and other accounts’ progress. Section 7 describes retained identifiers and their retention.
• Sign in with Apple (website and iOS, optional): the Apple account identifier becomes a player ID starting with apple:, without automatically merging Google accounts. Apple may provide a name, email or private relay address depending on your choices. These details are not stored in the game database. Cloud profiles, device links and reward claims are stored in Supabase as with Google sign-in.
• Email/password sign-in (website and iOS, optional, only on devices answered 16 or older): we store the email address, account identifier and salted password hash in the Supabase database for authentication. Plaintext passwords are used only for server verification and are not stored. Counts and lock times of login attempts are processed to prevent brute-force access. These accounts use the same game and profile-saving features as other signed-in accounts. Account deletion or expiry of the linked game profile also removes the email address and password hash.
• Web sign-in uses encrypted HttpOnly session cookies, which may contain names and email addresses supplied by Google or Apple, and a profile-picture URL for Google sign-in. The iOS app stores the server-issued game credential in the device Keychain. Apple private keys and client secrets are never included in the app.
• Board (free board and public Q&A board, website only): posts and comments can be read by anyone without signing in, and posts may be indexed by search engines. Writing requires a signed-in account (sign-in age rules are in section 8); guests cannot write. Supabase stores the public nickname you choose (2–16 characters, changeable once every 30 days), a random public author tag generated by the server (it cannot be derived from your account), posts (title, body, board kind), comments (including replies to other comments), upvotes (the upvoting account’s identifier, the target and the time), a change log of upvotes and withdrawals used for the rate limit (the account’s identifier and the time), reports (the reporting account’s identifier, the target and an optional reason of up to 200 characters), timestamps, and whether the operator has answered. The nickname, posts, comments and upvote counts are public; who upvoted is not. The name and email from your sign-in provider and your account identifier are not shown on the board. Posts containing links are rejected, and the number of posts and comments allowed in a period is limited.

5. The iOS app

The iOS app contains the game files, so it runs without a network connection. The app itself includes the Sentry SDK for error diagnostics and sends only the error information described in section 3. Its game events are relayed through the web API to Vercel Analytics as described in section 3, and only on devices answered 16 or older and after analytics consent does the app's PostHog SDK send the visit statistics in section 3 to PostHog. Ads in the iOS app and processing specific to the app are described in the app privacy policy. When connected, the app sends the information in section 4, including automatic startup requests; server errors from those web API requests may be processed by Sentry as described in section 3.

Links to the website, such as the privacy policy link in the app, open in your device’s default browser; from then on section 3 applies.

If you agreed in your device settings to share analytics, Apple may give developers crash reports and usage statistics. That information is governed by Apple’s privacy policy.

6. Service providers and international transfer

We use the providers listed below. Company domicile is not necessarily the data storage or processing location. Information needed for each feature is transmitted when you use the website or online features in the app. Error data is sent to Sentry’s US region; PostHog uses a US endpoint and the linked primary Supabase database is in Seoul. Backup, support-access and other processing locations depend on provider settings and terms; we do not claim these are the only countries involved. We do not sell information or share it with providers other than those listed below.

Transfer timing and method: information is sent over an encrypted network connection (HTTPS) each time you use the relevant feature. How to refuse and its effect: without or after withdrawing analytics consent nothing is sent to PostHog. To refuse transfers needed to provide the service (hosting, storage, error diagnostics, sign-in), do not use those features (online features, sign-in) or ask us to delete your account; those features are then unavailable. Each recipient can be contacted through the contact channel in its privacy policy.

• Vercel Inc. (United States): website hosting processes IP address, User-Agent, requested address and time. Independently of PostHog analytics consent, Vercel Analytics processes production-website pageviews and game events and iOS app game events (section 3)
• PostHog Inc. (United States): website and iOS app visit statistics and feature flags after analytics consent. The statistics in section 3, a random pseudonymous analytics identifier and the per-device pseudonymous analytics profile for it. Network metadata such as IP address and User-Agent may also be processed during transmission.
• Functional Software, Inc. (Sentry, United States): website, web-API and iOS-app error diagnostics. The error type, safe generated-bundle path, operation label, error code and iOS app version described in section 3
• Google LLC (United States): optional Google sign-in. Account identifiers, names, email addresses and profile information are described in section 4. https://policies.google.com/privacy applies.
• Supabase, Inc. (US-based; linked primary database region: Seoul, South Korea): storing online records (website and iOS app). The information in section 4
• NAVER mail: support messages are received at ycp998@naver.com. Mail processing and backup locations depend on NAVER’s service terms; a Korean email address does not prove all processing stays in Korea.
• Apple Inc. (United States): Apple sign-in and authorization revocation for web and iOS. Account identifiers and authentication information are processed under https://www.apple.com/legal/privacy/.
• Google LLC (United States, YouTube): playing a track on the website’s /soundtrack page. The YouTube player loads from youtube-nocookie.com when you press play, and your IP address and device and browser information are then sent to Google, which may process them with cookies and similar technologies. Before you press play, nothing is requested from YouTube. Google’s privacy policy (https://policies.google.com/privacy) applies.

7. Retention

• Device information other than Keychain credentials: until you clear it or delete the app
• Hosting logs: deleted under Vercel’s retention policy
• Visit statistics: under the respective service settings and retention policies of PostHog and Vercel Analytics. Withdrawing PostHog consent stops future PostHog collection but does not automatically delete records already sent. PostHog records collected while consent was active may finish transmission after withdrawal if they were queued, retrying or already in flight. Withdrawing PostHog consent does not affect Vercel Analytics collection or retention.
• Sign-in session: until sign-out or session expiry. Authentication security cookies follow their own expiry rules.
• Online records (section 4): the daily cleanup removes daily runs, votes, raid originals and shared links at the next scheduled cleanup after one calendar year from creation. Cloud saves expire one calendar year after the last successful save (updated_at), or earlier when the account is deleted. Device links and reward claims follow the linked account’s expiry; orphaned links and claims are removed at the next cleanup after one calendar year from their own timestamp.
• Sentry error diagnostics: kept under Sentry’s retention policy
• Account records: cloud saves are retained for one year after the last successful save, device links and reward claims follow the linked account’s expiry, and account deletion removes them earlier.
• Signed-in iOS account tokens expire within 30 days of issuance and are removed from Keychain on sign-out. Keychain credentials may remain after uninstalling the app. Token expiry ends authentication validity but does not automatically erase the stored value. Apple refresh tokens are not retained in the game database.
• Automated deletion covers primary game database records. Provider logs, advertising/analytics data and backups follow the relevant service settings and retention policies and are not erased by this SQL cleanup.
• Support requests: sender email address, message content and optional attachments are retained for one year after resolution for support, then manually cleaned; they are not part of the automated database cleanup. Do not send passwords, authentication tokens or secret keys.
• Deletion marker: the server retains the provider-based player identifier, authentication generation, deletion time and cutoff for earlier authentication. A deleted marker is removed at the next cleanup after one calendar year from deletion. Fresh authentication reactivates the identifier as account data while preserving the cutoff for earlier credentials. Guest deletion removes the guest credential and profile without retaining a guest deletion marker.
• After account deletion, previous authentication tokens and the authentication generation are revoked so they cannot resurrect a new profile. Rejoining with the same provider account requires fresh provider authentication after a conservative clock-skew delay (about 60 seconds); the provider identifier and cutoff for earlier authentication are retained as described above.
• Guests can also use Delete account in Settings to remove the guest profile, credential information and pending synchronization. A temporary network failure is not reported as successful deletion; the user can retry. Other devices clear only that account at their next synchronization.
• Guest credentials are separate from account tokens and do not follow the 30-day expiry rule. Server credential hashes and account-binding information are removed when the linked profile is deleted; consumed or orphaned credential records are removed at the next cleanup after one year from creation. The device Keychain value may remain after uninstalling the app.
• Apple authentication information is subject to Apple’s retention policy; we do not set third-party retention periods.
• Board posts, comments and nicknames (section 4): kept until the author deletes them or the account is deleted. When an author deletes a post, its title and body are erased and its comments remain; deleting a comment erases that comment’s body. A deleted post or comment stays linked to the author’s account until the account is deleted. When an account is deleted, or cleaned up at the end of the account retention period above, its posts and comments are kept only as empty “deleted” entries with no author, and the nickname and the reports that account made are deleted. That account’s upvote records are deleted too, and the upvote counts stay as they are. The upvote change log used for the rate limit is deleted with them, and older than 24 hours is erased by an hourly cleanup job even if the account is not deleted. Posts and comments hidden after three different accounts reported them keep their content on the server for operator review, until the author deletes them or the account is deleted. Content that search engines or other people have already copied cannot be removed by us.
• YouTube playback information (section 6): not stored in our database; Google’s retention policy applies.

8. Children

People under 13 may also use the service. For every age, gameplay, saves tied to a random guest identifier, and rankings that show only country and record (no names) are processed minimally as needed to provide the service. We ask for a birth year once, when you first enter the lobby; before you answer, or if you skip, the device is treated like one that did not answer, in the most restricted way. Under 13, Google, Apple and email sign-in are not offered (sign-in providers hand over names and emails). On devices under 16 or that have not answered, consent-based PostHog analytics and email/password sign-in are not offered. A year alone cannot tell whether this year's birthday has passed, so age is counted at its lowest. The birth year itself is not stored; only the age band (under 13 / 13 to 15 / 16 and over) is saved on the device and it is not sent to our server. There is no separate guardian-consent process or parental-control features. A guardian can ask us by email to delete a child's guest or account records.

9. Your rights

You can clear the information on your device at any time. If you signed in, Delete account in the settings removes your cloud save, device links and reward claims, and clears that account’s profile and pending synchronization on this device. Guest and other accounts’ progress, account preferences, daily runs, votes and shared links remain. The game’s “Reset progress” resets the game profile through a server command; it does not delete the account or every online record. clearing the browser’s site data or deleting the app removes the section 2 device information except Keychain credentials.

Deleting a game account signed in with Apple requires Apple reauthentication after the two-step confirmation. We verify that it is the same game account, revoke Apple authorization, then delete the server account. Cancellation, mismatched identity or authentication/revocation failure preserves server data; retry or contact us for help. Sign-out retains that account’s local progress and switches to a separate guest profile. Account deletion clears that account’s profile and pending synchronization on this device. When the account is deleted on another device or its cloud save expires, other signed-in devices clear that account’s profile and pending synchronization at their next synchronization and sign out. Separate daily records, votes and shared links are not deleted with the account; they follow the retention periods in section 7.

PostHog analytics collection is optional. You can accept or reject in the website's analytics consent banner or the consent screen shown after the age question, and withdraw consent at any time through Analytics settings in the game’s Settings tab to stop future PostHog collection. You can still play if you reject or withdraw consent. Vercel Analytics operates independently of this choice on the production website and cannot be disabled through these consent settings.

For access or deletion questions about hosting logs and visit statistics, contact us below. Requests may be limited for records that we cannot link to a specific person.

• Board: you can delete your own posts and comments on the board, and change your nickname once every 30 days. Section 7 governs what happens to board information when you delete your account. You can report other users’ posts and comments (once per account for each post or comment, not your own), and a post or comment is hidden automatically when three different accounts report it. Upvoting requires a nickname. You can withdraw an upvote at any time; you cannot upvote your own posts and comments, and the number of upvotes and withdrawals in a period is limited. For requests to delete a post or questions about a report, write to the email below.

10. Changes

If the information we process or our providers change, we will update this page and its effective date. Changes are announced on this page and in the game from 7 days before they take effect, and changes that are adverse to users, such as new collected items or new third-party sharing, from 30 days before. Changes that legally require consent apply only after consent. Earlier versions are available by email on request.

11. Purposes, items, legal basis and retention

Gameplay information and online-feature information needed to provide the service are processed minimally on a service-provision basis. The basis classification below is the operator's reading and has not been reviewed as legal advice. Optional analytics, ads and ad tracking, and marketing are kept apart from game saving; rejecting or withdrawing them does not affect play or saves. Each numbered section gives the details.

• Game saving: Purpose — saving progress, currency and gear. Items — game profile. Basis — processing needed to provide the service (the operator's reading of Article 15(1)(4)). Retention — one year after the last save, or until deletion is requested (section 7).
• Guest profile: Purpose — keeping saves without signing in. Items — random guest credential key, device ID; no names or contact details. Basis — processing needed to provide the service (the operator's reading of Article 15(1)(4)). Retention — one year after the last save, or until deletion is requested (section 7).
• Google and Apple sign-in (optional, devices answered 13 or older): Purpose — confirming the account and continuing on another device. Items — provider account identifier (google:, apple:), authentication generation and time. Names and emails are not stored in the database. Basis — processing to provide the sign-in the user chose (the operator's reading of Article 15(1)(4)). Retention — until account deletion or save expiry; deletion history one year after deletion (section 7).
• Rankings and online records (daily runs, faction votes, raids, shared links): Purpose — running rankings and events. Items — device ID, country, run record; no names shown. Basis — processing to provide game features (the operator's reading of Article 15(1)(4)). Retention — one year after creation (section 7).
• Security and operation records (web hosting logs, error reports): Purpose — providing the service, handling failures, preventing abuse. Items — IP address, User-Agent, requested address and time, error details. Basis — processing needed to operate the service (the operator's reading of Article 15(1)(4)). Retention — per each provider's settings (sections 6 and 7).
• Support: Purpose — answering requests. Items — sender email address, message and attachments. Basis — handling the user's request (the operator's reading of Article 15(1)(4)). Retention — one year after resolution (section 7).
• Optional analytics (PostHog, website and iOS app): Purpose — understanding return visits, retention and gameplay flow. Items — pseudonymous analytics identifier and per-device pseudonymous analytics profile, page and game events, browser and device details. Basis — Article 15(1)(1) (consent). Not asked and kept off on devices under 16 or that have not answered the age question. Retention — per PostHog settings; withdrawal stops future collection (section 7).
• Email/password sign-in: Purpose — offering an optional sign-in method. Items — email address, salted password hash, login attempts. Basis — Article 15(1)(1) (consent). Offered only on devices answered 16 or older. Retention — until account deletion or expiry (section 7).
• Marketing: we do not send messages or process data for marketing. If that changes, we will ask for separate consent.
• Board (free board and public Q&A board): Purpose — publishing the posts, comments and questions you write, operator answers, showing upvote counts, handling reports and limiting spam posting. Items — public nickname, public author tag, posts and comments, upvotes (upvoting account identifier, target, time), upvote change log (account identifier, time; kept 24 hours, cleaned up hourly), reports (reporting account identifier, target, reason), timestamps, whether the operator has answered. Basis — processing to provide the board feature for content the user posts (the operator's reading of Article 15(1)(4)). Retention — until the author deletes it or the account is deleted (section 7).
• YouTube video playback (website /soundtrack, only when you press play): Purpose — playing the track video you chose. Items — your IP address and device and browser information (collected by Google through the player, section 6). Basis — processing to provide the feature you requested by pressing play (the operator’s reading of Article 15(1)(4)). Retention — not stored by the operator; Google’s retention policy applies (section 7).

12. Ads

The website currently shows no ads and stores no advertising cookies or identifiers. If web ads (Google AdSense) are turned on, this policy will be updated first and announced as described in section 10, and consent will be collected through a Google-certified consent management platform where the law requires it.

Ads in the iOS app are described in the app privacy policy.

13. Security measures

We take the following security measures.

• Encryption in transit: traffic between the website, web API and external services is encrypted with HTTPS.
• Credential protection: passwords are stored only as salted hashes and guest credentials only as hashes. Web sessions use encrypted HttpOnly cookies and the iOS app keeps credentials in the Keychain.
• Access control: the database has row-level security on with no public access policies, and only the server reaches it with a separate service key. Service keys and secrets are never included in the app or browser. One person, the operator, can access operational data.
• Minimal processing and cleanup: sign-in provider details such as names and emails are not stored in the database, and expired records are removed by the daily cleanup.

14. Destruction procedure and method, automatic collection

• Destruction procedure: when a retention period in section 7 ends or account deletion is requested, the records are removed by the daily cleanup or the deletion request. No information currently has to be kept under other laws.
• Destruction method: electronic records are deleted from the database so the service cannot load them again; no paper records are made. Provider backups and logs are removed under each provider’s retention policy. Support mail is deleted by the operator.
• Automatic collection devices: the website uses sign-in session and security cookies and a language cookie (NEXT_LOCALE), and PostHog cookies only after analytics consent. The iOS app stores the PostHog identifier in localStorage only after analytics consent. The website and app store settings and the device ID in localStorage.
• Refusing automatic collection: you can block cookies or clear site data in your browser, and refuse analytics in Analytics settings in the game’s Settings tab. Blocking sign-in cookies makes web sign-in unavailable.

15. Remedies

For reports or advice about a privacy infringement, you can contact the following Korean authorities.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center (KISA): dial 118 (privacy.kisa.or.kr)
• Supreme Prosecutors’ Office: dial 1301 (www.spo.go.kr)
• Korean National Police Agency: dial 182 (ecrm.police.go.kr)