Privacy Policy
Triple Friends (the "App")
Effective date: October 22, 2026
DeepXRLab Co., Ltd. (the "Company") complies with the Personal Information Protection Act of Korea and other applicable laws, and processes the personal information of people who use the App ("users") as described below.
You can use the App without signing up. When you first open the App, a guest account is created on the Company's server, and your game progress, currency and purchase records are stored on the server under that account. We do not collect passwords, names or phone numbers. If you wish, you can link a Google or Apple account to keep the same records when you change devices.
1. Personal information we process and why
| Category | Items | Purpose | How collected |
|---|---|---|---|
| Guest account | Guest number and authentication token issued by the server, nickname (generated automatically or chosen by you), device type (Android · iOS), app version, language setting, country of connection (based on IP; the IP address itself is not stored), device identifiers created by the App (install identifier · device session identifier; on Android the install identifier is derived from the identifier the device gives the App (ANDROID_ID)) | Telling users' records apart, keeping and restoring records, grouping records from the same device, preventing abuse | Automatically when the App runs |
| Account linking (optional) | Unique identifier of your Google or Apple account, email address (for Apple, this may be a hidden relay address), and for Apple, the refresh token Apple issues (we ask Apple to revoke it when you delete your account) | Continuing the same records on a new device, restoring purchases | When you tap account linking in Settings |
| Game records | Level progress, currency · item balances and changes, Daily Challenge · league · ranking records, play events (round start · end · result, etc.) and the country of connection for each event (based on IP; the IP address itself is not stored) | Keeping and restoring game progress, showing rankings (your nickname and score are visible to other users), statistics for difficulty tuning and service improvement (including usage statistics by country) | Automatically while you play |
| Purchases | Store type, product ID, store transaction number, receipt verification result, delivery history | Verifying purchases and delivering items, handling refunds · disputes | Automatically on in-app purchase. Payment method details such as card numbers are handled by Apple · Google; the Company does not receive them |
| Ad rewards | Rewarded ad completion records (ad unit, device session identifier, reward history) | Granting ad rewards, preventing duplicate rewards | Automatically when you finish a rewarded ad |
| Support inquiries (optional) | Inquiry type · subject · content, email address (only if you want a reply), country · region, guest number or device identifier, app version | Reviewing and answering inquiries | When you send an inquiry from Support |
| Access logs | IP address, browser · app information (User-Agent), request time | Server operation · error checking · blocking abnormal requests | Automatically when connecting to the server |
2. Information collected by third-party tools
The App includes the third-party tools below, and each tool collects information directly from your device while you use the App. Each company processes that information under its own policy.
| Tool (company) | Purpose | Information collected |
|---|---|---|
| Google AdMob (Google LLC) | Showing ads, verifying rewarded ad views | Advertising identifier (Android advertising ID; on iOS, IDFA only if you allow tracking), device · OS information, IP address, ad impression · click information. Ads may be personalized based on this information |
| Firebase Analytics (Google LLC) | Usage statistics (e.g. which screens · levels users leave at) | App instance ID, install identifier · device session identifier created by the App, play events, device · OS information, advertising identifier (same conditions as above). We configure it not to send ad personalization signals |
| Firebase Crashlytics (Google LLC) | Analyzing app errors | Error logs, device state at the time of the error (OS version · device model, etc.), install identifier, app version, the round you were last playing |
| Meta App Events (Meta Platforms, Inc.) | Measuring installs · usage from Meta ads | Automatically logged events such as app install · launch · in-app purchase, tutorial completion · level reached events, advertising identifier (Android advertising ID; on iOS, IDFA only if you allow tracking), device information |
- On iOS, the App asks whether you allow tracking; if you do not, IDFA is not used. You can change this at any time in Settings > Privacy & Security > Tracking.
- On Android, you can reset or delete your advertising ID in device Settings > Privacy (or Google) > Ads.
3. Retention period
| Item | Period |
|---|---|
| Guest account · account linking · game records | Kept until you delete your account in the App or request deletion, then destroyed without delay |
| Purchase · currency delivery records | When you delete your account, the link to your account is removed and the records are kept for 5 years under the Korean Act on Consumer Protection in Electronic Commerce, then destroyed |
| Play event · ad reward records that carry only a device identifier | For accounts deleted on or after October 22, 2026, they remain with no link to your account for 1 year, then destroyed. Records of accounts deleted before that date remain without any link to an account |
| Support inquiries | Kept for 3 years after handling under the Korean Act on Consumer Protection in Electronic Commerce, then destroyed |
| Access logs | Kept for up to 3 months, then destroyed |
| Firebase Analytics | Event data is deleted by Google after 2 months, and user-level data 14 months after your last activity |
| Firebase Crashlytics | Error logs are deleted by Google after 90 days |
| Records stored on the device | Until you uninstall the App or delete your account in the App |
Where the law requires retention, we keep the information for that period.
4. Provision to third parties
The Company does not provide users' personal information to third parties, except for information collected directly by the third-party tools in Section 2 and requests made under the law.
5. Outsourcing and international transfer
To provide the service, the Company outsources personal information processing as below. Processors do not use personal information for any purpose other than the outsourced work. Information is transferred over the network while you use the service.
| Processor | Outsourced work | Location | Retention |
|---|---|---|---|
| Vercel Inc. (USA) | Running the game server · purchase verification server (handling storage · lookup requests for the information in Section 1) | Republic of Korea (Seoul) | Not stored after processing. Access logs as in Section 3 |
| Amazon Web Services, Inc. (USA) | Running the database (storing the information in Section 1) and the support server | Asia Pacific (Seoul) | As in Section 3 |
| Google LLC (USA) | Usage statistics · error analysis (Firebase Analytics · Crashlytics) | Google data centers in the USA and elsewhere | As in Section 3 |
6. Destruction of personal information
Personal information whose retention period has ended or whose purpose has been fulfilled is destroyed without delay. Electronic files are deleted in a way that cannot be recovered.
7. Your rights and how to exercise them
You may at any time request access to, correction of, deletion of, or suspension of processing of your personal information.
- Delete in the App: Settings > Delete account deletes the guest account, linked account and game records on the server, and then the records on your device. If the server cannot confirm the deletion (for example, with no internet connection), nothing is deleted and the App tells you. For accounts linked with Apple, we also ask Apple to remove the link.
- On deletion, the App creates new analytics identifiers for this device (install identifier · device session identifier · Firebase app instance ID). Analytics data already collected is deleted by Google after the retention period in Section 3.
- Purchase · currency delivery records are kept for the period in Section 3 with the link to your account removed.
- Request by inquiry: you can send a request through Support (https://triple-friends-backend.vercel.app/help) or to support@deepxrlab.com. If you have already uninstalled the App, please include the email address of your linked account.
- If you only uninstall the App: only the records on your device are deleted; the records on the server remain.
The rights of children under 14 may be exercised by their legal guardian.
8. Age
The App is not primarily directed at children and does not ask for your age. If we learn that personal information of a child under 14 has been collected without a legal guardian's consent, we destroy it without delay.
9. Security measures
- Network transmission is encrypted (HTTPS).
- Guest · linked-account authentication is verified with tokens signed by the server. Apple refresh tokens and account unique identifiers are not exposed even in the admin screens.
- Access to personal information is limited to the minimum number of staff.
10. Privacy officer
| Item | Details |
|---|---|
| Privacy officer | Byeongseon Hong (Customer Support team) |
| Contact | https://deepxrlab.com/contact · cs@deepxrlab.com · App inquiries support@deepxrlab.com |
If you need to report or get advice about a privacy violation, you can contact the following agencies (Korea).
- Personal Information Infringement Report Center: privacy.kisa.or.kr / 118
- Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
- Supreme Prosecutors' Office Cyber Investigation Division: www.spo.go.kr / 1301
- Korean National Police Agency Cyber Bureau: ecrm.police.go.kr / 182
11. Changes to this policy
When we change this policy, we announce it on this page at least 7 days before it takes effect (30 days for changes that significantly affect your rights).
- Announced: October 22, 2026
- Effective: October 22, 2026