Privacy Policy
The Wanted City operator (“we”, “us”) follows the Personal Information Protection Act of the Republic of Korea and other applicable laws. This policy explains what personal data we process, why, and the choices you have.
1. Scope
This policy covers our game Wanted City (mobile apps, PC and web browsers) and the websites wantedcity.io and play.wantedcity.io (the “Services”). Services of Google, Apple, Toss and other providers you reach through the Services, and our community channels (Discord, X), follow their own policies. In the community channels we process only your public username and user ID and the messages posted there, to keep order, and we do not link them to your game account.
2. Data we process and how we collect it
| Category | Data | Source |
|---|---|---|
| Account (required) | Member number, Firebase user ID, sign-in provider and its account identifier (Google, Apple, Toss, Patreon, Wavedash, CrazyGames), and the email address and display name if the provider shares them. Guest accounts use an anonymous identifier stored on the device | Your sign-in provider, when you sign in |
| Gameplay (required) | Nickname, character appearance and class, items, currency and inventory, island and building data, trades between players, in-game position and play history, sanctions | Created as you use the Services |
| Chat | Sender and recipient identifiers, displayed names, message text and time | Entered by you. Public chat is stored on our game servers for 24 hours. Accepted direct conversations and reports are also stored to provide messaging and investigate abuse |
| Purchases | Product, order number and receipt data, purchase time and amount, refunds | The app store (Google Play, App Store, Toss), Patreon for memberships (membership status, tier and charge status), Wavedash for purchases there. We never receive card numbers or other payment instrument details |
| Collected automatically | IP address, access times, device model, operating system and version, app version, language, usage records (screens reached, play time, frame rate, in-game events such as purchases with game money), and anonymous error and crash reports only if you turn on “Anonymous bug reports” in the game's settings (off by default; they carry no account or player identifier) | Generated by the app, our servers and websites. Usage records go through our servers to Google Analytics under your member number, without your name, email or IP address and without ad personalization |
| Advertising (where ads are shown) | Advertising ID (Android advertising ID, iOS IDFA), ad impressions and clicks, approximate location derived from IP | Collected by the ad SDK (Google AdMob) |
| Support and reports | Email address, message, attachments | You, when you email us |
We do not collect national ID numbers or sensitive data.
On CrazyGames, we verify a signed platform token and use its game-specific user identifier and username to sign you in and display your name in multiplayer. The CrazyGames edition offers no external sign-in, real-money purchases or advertising. CrazyGames operates its own platform under its privacy policy.
3. Purposes
- Identifying you, signing you in, maintaining your account and restoring it on a new device
- Running the game: saving characters, islands and items, multiplayer, chat and trades
- Verifying and delivering purchases, handling withdrawals and refunds
- Preventing fraud (hacking, bots, payment abuse), enforcing restrictions and handling disputes
- Diagnosing errors, keeping servers stable, improving performance, statistics
- Showing ads and measuring them (personalized ads only where you have consented or not opted out, as the law requires)
- Answering questions and reports, sending service notices
- Meeting legal obligations
4. Retention
Guest accounts expire 24 hours after creation, and their characters and progress are removed. On CrazyGames, signing in to a newly registered game account transfers the current unexpired guest progress to that account. Signing in to an existing game account restores that account’s own progress.
We delete personal data without delay once its purpose is met, for example when you delete your account, except for the following.
| Data | Period | Basis |
|---|---|---|
| Records of contracts, withdrawals, payments and delivery | 5 years | Korean Act on Consumer Protection in Electronic Commerce |
| Records of consumer complaints and disputes | 3 years | Same Act |
| Access logs (sign-in records, IP address) | 3 months | Korean Protection of Communications Secrets Act |
| Fraud and sanction records | 1 year after account deletion | Preventing evasion of sanctions by re-registering (our policy) |
5. Sharing with third parties
We use personal data only for the purposes in section 3 and share it with third parties only with your consent or where the law allows it (Articles 17 and 18 of the Personal Information Protection Act). We currently share no personal data with third parties. We do not sell personal data.
6. Processors and international transfers
These service providers process data on our behalf; some of them process it outside Korea. Data is sent encrypted over the network as you use the Services and is kept until you delete your account or the contract with the provider ends.
| Processor (country) | Service | Data |
|---|---|---|
| Google LLC (USA) | Firebase Authentication, Google Analytics, Google Sign-In, Google Play billing, AdMob ads | Account, gameplay, purchase, automatic and advertising data |
| Apple Inc. (USA) | Sign in with Apple, App Store payments | Account and purchase data |
| Amazon Web Services, Inc. (USA; servers in the Tokyo, Japan and N. Virginia, USA regions) | Game servers and databases | Account, gameplay, chat and automatic data |
| Cloudflare, Inc. (USA) | Website hosting, content delivery, security | IP address, access logs |
| Viva Republica Inc. (Korea) | Toss sign-in and Toss payments | Account and purchase data |
| Patreon, Inc. (USA) | Patreon sign-in and memberships | Account and purchase data |
Our contracts bind these providers to process data only for our purposes, protect it, restrict sub-processing, accept our supervision and be liable for damages. We will update this policy if the providers or their tasks change. You can stop transfers abroad by deleting your account, after which you can no longer use the Services.
7. Deletion
Data whose retention period has ended or whose purpose has been met is deleted without delay (within five days at most). Data we must keep by law is stored separately and deleted when its period ends. Electronic files are deleted so that they cannot be recovered; paper is shredded or incinerated.
8. Your rights
- You may at any time ask to access, correct or delete your personal data, to suspend its processing, or withdraw your consent.
- You can delete your account in the game's settings or by email as described on Delete your account.
- Send requests to [email protected]. We verify your identity and act within 10 days. A legal guardian or an authorized agent may make requests for you.
- Where another law requires us to keep data, we cannot delete it and will tell you why.
9. Children
Processing personal data of children under 14 in Korea requires a legal guardian's consent; elsewhere we follow the local age of digital consent (for example 13 in the USA and up to 16 in the EEA). If we learn that we collected a child's data without the required consent, we delete it without delay. We do not show personalized ads to children.
10. Cookies, device storage and personalized ads
- Our websites use no advertising or tracking cookies. They store settings such as your language in browser storage (localStorage), which you can clear in your browser. The web game may keep progress data in browser storage.
- Where the app shows ads, Google AdMob uses the advertising ID to choose ads and measure them. You can accept or refuse personalized ads on the consent screen and change your choice in the app's settings at any time.
- You can also opt out on your device. Android: Settings → Google → Ads → Delete advertising ID. iOS: Settings → Privacy & Security → Tracking → turn off Allow Apps to Request to Track.
- See How Google uses information from sites or apps that use its services.
11. Security
- Encryption in transit (HTTPS, WSS) and server-side verification of sign-in tokens
- Least-privilege access to systems that hold personal data; keys and secrets kept separately
- Access logs kept and protected from tampering; security updates applied
- An internal management plan and regular reviews
12. Privacy officer
For questions, complaints or remedies about personal data, contact us and we will answer without delay.
- Privacy officer: Privacy contact (Wanted City operations)
- Email: [email protected]
13. Complaints in Korea
- Personal Information Dispute Mediation Committee: +82 1833-6972, www.kopico.go.kr
- Personal Information Infringement Report Center (KISA): 118, privacy.kisa.or.kr
- Supreme Prosecutors' Office: 1301, www.spo.go.kr
- Korean National Police Agency: 182, ecrm.police.go.kr
14. EEA and UK users (GDPR)
- The controller is the Wanted City operator (Republic of Korea, [email protected]).
- Legal bases: account, gameplay and purchases — performance of a contract (Art. 6(1)(b)); fraud prevention, security and error analysis — legitimate interests (Art. 6(1)(f)); personalized ads and the advertising ID — consent (Art. 6(1)(a)); keeping transaction records — legal obligation (Art. 6(1)(c)).
- You have the right to access, rectify and erase your data, restrict or object to processing, data portability, and to withdraw consent at any time without affecting earlier processing. You may complain to the supervisory authority where you live.
- Transfers outside the EEA and UK (to Korea, Japan, the USA and others) rely on the EU adequacy decision for the Republic of Korea, the providers' Standard Contractual Clauses, or the EU-US Data Privacy Framework (Japan is also covered by an EU adequacy decision).
- We make no decisions with legal effects about you based solely on automated processing.
15. California users
We do not sell personal data. Advertising IDs may be shared with ad providers for personalized ads; you can opt out as described in section 10. California residents may ask to know, delete or correct the personal data we hold, and we will not discriminate against you for doing so.
16. Changes
We announce changes on this page and in the Services at least 7 days before they take effect, or 30 days before changes that materially affect your rights.