Privacy Policy

Effective date: August 6, 2026 · Last revised: August 6, 2026

This document is a translation of the Korean original. If the translation and the Korean original differ in meaning, the Korean original prevails. View the Korean original

English

Hi-eut Hi-eut, the operator of Dokal Game (“Operator”), complies with applicable privacy, e-commerce, and data protection laws. This Privacy Policy applies to Dokal Game websites and web apps, games, Dokal Shop, advertising and collaboration features, donations, acorn wallets and rewards, Dokal Hunch, in-store order verification, Dokal Chatbot, and other services provided by the Operator.

1. Personal data we process

Depending on the features you use, we may process the following information.

Category	Data
Account and authentication	Email address, password hash, name and phone number if provided, account role, registration and deletion timestamps, login provider, social-login identifiers and tokens when used, session ID and expiration time
Guest and device identity	Server-signed guest identifier, client identifier, cookies, session values, and service identifiers stored in the browser
Access and security	IP address, access time, requested path, browser, operating system and device information, User-Agent, error and security events, rate-limit records, and administrative access logs
Games, acorns and leaderboards	Game ID, start and completion times, play duration, performance, reward sessions, acorn balance and ledger, public player ID, ranking, anti-duplication and reward-cap data, and local-balance migration records
Participation features	Predictions, votes, comments, settlement results, free-point claims, acorn request-board activity, and in-store order verification stamps and rewards
Dokal Shop	Cart, order number, products, options, quantity, price, order, payment, cancellation, refund and shipment status, recipient name, phone number, postal code, address, detailed address, and minimum data required for supplier fulfillment and delivery
Payments	Payment method type, authorization and cancellation status, amount, time, order ID, payment key and other integration identifiers, and virtual-account bank, number, due date and status where applicable. The Operator does not directly store full card numbers or CVC codes.
Advertising	Advertiser account, images, videos, copy, destination URL, requested dates or period, review status, payment information, impressions, clicks, rewarded-ad nonce, and daily-cap data
Donations	Amount, order and payment identifiers and status, display name, support message, anonymous setting, Hall of Fame visibility, and cancellation or refund history
Dokal Chatbot	Conversation text, minimum conversation history needed to generate a response, risk classification and block codes, latency and error-stage metadata. We attempt to mask email addresses, phone numbers, national IDs, card and bank-account numbers, IP addresses, and tokens before model transmission.
Support and disputes	Inquiry, response, attachments, and transaction or incident records needed to investigate the request

Some standalone games store progress and settings only in the browser’s localStorage. That information remains on the device until deleted. Limited data may be transmitted when you use server rewards, account synchronization, or wallet migration.

2. How we collect data

Information you provide through registration, login, orders, advertising, donations, inquiries, or AI conversations
Information generated automatically during gameplay, payment, delivery, ad viewing, clicking, or reward claims
Information received from payment processors, login providers, suppliers, and carriers as needed to provide the service
Cookies, sessions, server logs, and browser storage

3. Purposes of processing

Account identification, login, session maintenance, recovery, and security
Gameplay, save and continue, acorn rewards, wallets, and leaderboards
Predictions, comments, voting, free points, and in-store verification
Dokal Shop ordering, payment, delivery, cancellation, refund, and support
Advertising registration, payment, review, delivery, and aggregated measurement
Donation payment, Hall of Fame display, cancellation, and refund
Dokal Chatbot responses, harmful-request moderation, and prevention of personal-data or secret leakage
Prevention of duplicate rewards, payment fraud, account takeover, automated attacks, and abuse
Incident analysis, quality improvement, legal compliance, and dispute resolution

4. Retention

Account data: until account deletion or completion of the purpose, except for minimum data retained separately to prevent abusive re-registration for a disclosed period
Contract and withdrawal records: 5 years
Payment and supply records: 5 years
Consumer complaint and dispute records: 3 years
Advertising records: 6 months
Access and security logs: generally up to 1 year, or longer where required for a security incident, legal obligation, or dispute
Acorn, reward, and store-verification records: for the period necessary to provide the service and prevent abuse, subject to statutory retention
Dokal Chatbot conversations: as a rule, the Operator does not persistently store raw conversation content in its own database. Conversation text may remain in browser memory until refresh or close. If an external AI provider is used, its abuse-monitoring retention policy may apply.
Browser localStorage: until you clear browser data, reset the device, or reset the relevant game

After the applicable period, information is securely deleted or separately retained where required by law.

5. Sharing and processors

We do not sell personal data. We may entrust processing or share minimum necessary information as follows.

Recipient or processor	Purpose	Data
Toss Payments	Payment authorization, cancellation, refund, and virtual-account processing	Order ID, amount, method, status, and payment identifiers
Replit, Inc.	Hosting, server execution, databases, file storage, networking, and security	Personal data and usage records processed by the service
OpenAI, L.L.C.	Response generation and harmful-content moderation when the external Dokal Chatbot provider is enabled	Masked conversation content and technical request information
Dokal Shop suppliers and carriers	Fulfillment, packing, shipping, returns, and exchanges	Ordered items and minimum recipient and delivery information

We may also disclose data with your consent or in response to a valid legal request.

6. International transfers

6.1 Replit cloud infrastructure

Recipient: Replit, Inc. and its infrastructure subprocessors
Country: primarily the United States
Timing and method: encrypted network transfer during service use, server storage, and backup
Data: service data described in Section 1 as necessary for the relevant feature
Purpose: hosting, database and file storage, security, and recovery
Retention: according to our retention periods and the service agreement

6.2 OpenAI-powered Dokal Chatbot

This section applies only when the external OpenAI provider is enabled and you send a message to Dokal Chatbot.

Recipient: OpenAI, L.L.C.
Country: United States
Timing and method: encrypted transmission when the AI message is sent
Data: masked conversation content and technical data needed for model and safety processing
Purpose: response generation and harmful-content moderation
Retention: under OpenAI’s business and API policies; abuse-monitoring logs may generally be retained for up to 30 days. API inputs and outputs are not used to train models unless the customer explicitly opts in.

You can refuse this OpenAI transfer by not using Dokal Chatbot. Other Dokal Game features will generally remain available. If a private or internal model provider is configured, messages may not be sent to OpenAI; the provider and privacy notice shown in the AI interface indicate the current processing route.

7. Public information

Leaderboards may display a public player ID, masked name, or service display name instead of raw email or phone information.
If a donor chooses Hall of Fame publication, the display name and support message may be public. Anonymous donors are shown under the service’s anonymous label.
Approved ad media, copy, and destination URLs are shown to users.
Content posted in public areas, such as comments, may be visible to others. Do not post personal information there.

8. Cookies, sessions, and browser storage

We use essential cookies, sessions, and localStorage for login, guest identity, security, settings, and game progress. Blocking or deleting them may prevent login, wallets, save and continue, or payment-return flows from working correctly.

9. Your rights

Subject to applicable law, you may request access, correction, deletion, suspension of processing, withdrawal of consent, or account deletion. Records that must be retained by law may remain separately stored. We may require reasonable identity verification before acting on a request.

10. Children and minors

Paid orders, advertising, donations, or other transactions requiring legal-guardian consent must be made with the required consent. If we learn that a child’s data was collected without required consent, we may verify and delete it as required by law.

11. Security measures

Password hashing and session-based authentication
Authorization for administrative and sensitive APIs, CSRF and CORS controls, and security headers
Isolated payment documents and verification of amount, order ID, and payment key
Input validation, HTML and URL sanitization, and upload-type checks
Rate limits, nonces, unique indexes, and atomic processing against duplicate rewards
Redaction of secrets and personal data from logs
Dokal Chatbot input classification, RAG authorization, output DLP, canary secrets, and metadata-only audit logs
Least-privilege database and storage access and server-side secret management

No electronic safeguard can eliminate every risk. If an incident is confirmed, we will take notification, reporting, and remediation steps required by law.

12. AI notice

Dokal Chatbot generates automated responses that may contain errors or omissions. Seek a qualified professional for legal, medical, financial, or other professional decisions. Do not enter passwords, API keys, card data, national IDs, or another person’s personal information into the AI interface.

13. Privacy contact

Operator: Hi-eut Hi-eut
Email: yunkisan94@naver.com
Phone: 0507-1371-7445

14. Changes and controlling language

We may revise this Policy when the service or law changes. Material changes will be announced in advance through the service, policy page, or email where appropriate. If the Korean version and a translation conflict, the Korean version controls to the extent permitted by applicable law.