Fledgelight Privacy Policy
This policy explains what the online features of Fledgelight (the "Game") process, under Korea's Personal Information Protection Act and other applicable law. The Game receives no accounts, names, emails or payment details, and you can play without its online features.
1. What we process
- Game progress and settings stay on your computer.
- If you use the online market (The Exchange), our game server (game.yhisoft.com) stores your randomly generated Seraph name (shown to other players), the items you list (name, type, rarity, stats) and their prices, and your purchase requests. The random seller key your computer creates so only you can collect your sales is stored only as a one-way hash.
- Install token: before your first market action the server issues a random token that the game sends with market requests (to limit abuse per installation). The server keeps only its hash and the game edition, version and operating system.
- Daily Rift: requesting today's rift sends nothing about you beyond the date.
- Every online request carries the game version, edition and operating system in its headers (for example Fledgelight/1.0.0 (complete; windows)); the install-token request also sends them in its body.
- Your IP address is used to answer and for short-term rate limiting (a hash that changes every day); it is not stored.
- Anonymous gameplay statistics are sent only if you turn them on (off by default): a random anonymous id and session id, the game version, edition and operating system, and game events with small numbers. Your country is estimated from the connection.
- Server statistics: the market server records, without any player identifier, counts of installs, listings, sales and payouts, item type, rarity and price, game version, edition and operating system, and error types.
2. Purpose and retention
- Used only to run the market (listings, purchases, payouts), to prevent abuse and to improve the game.
- Live listings stay until sold or removed by the operator; sold listings (including the buyer's Seraph name) are kept 30 days; uncollected proceeds until you collect them (the payout record 180 days after); install-token hashes while the service runs.
- Anonymous gameplay statistics and server statistics: kept up to 1 year (365 days) from collection, then deleted.
- How data is destroyed: when the retention period ends or you ask for deletion, we delete it without delay from our database and storage so it cannot be restored. We keep no paper records.
3. Processors and international transfers
| Recipient (contact) | Country | Data | Purpose | Retention |
|---|---|---|---|---|
| Cloudflare, Inc. (contact: dpo@cloudflare.com) | USA (data centers worldwide) | Market data, install-token hashes, requests in transit | Game server and database | As in section 2 |
| Tinybird, Inc. (contact: legal@tinybird.co) | USA (data stored in the operator account's region: USA or EU) | Anonymous gameplay statistics (if on), server statistics | Usage statistics and error analysis | Up to 1 year from collection |
Legal basis: Article 28-8(1)(iii) of Korea's Personal Information Protection Act (outsourcing and storage needed to perform our contract with you, disclosed in this policy). When and how: each time you use an online feature, the game sends it to the game server; the game server sends statistics to the analytics service over encrypted connections (HTTPS). If you do not want any transfer, don't use the market or statistics; the Game plays fully offline.
4. Your rights
- You can ask to access, correct, delete or stop the processing of your data at any time. Contact us below with your Seraph name and we will act without delay.
- You can turn anonymous gameplay statistics off at any time in the game's settings.
5. Children
The Game's online features receive no identity information such as names or contact details. Children under 14 should use them with a parent's or guardian's consent.
6. Security
- Seller keys and install tokens are stored only as one-way hashes.
- Rate limits and daily caps, least-privilege server access, and secret keys kept separately.
- Because of a technical limit of the game client, the game server is reached over unencrypted HTTP. That is why the Game never sends identity information.
7. Privacy officer
[Operator] · [Contact]
8. Changes
We announce changes on this page at least 7 days before they apply (30 days for important changes).