Battle Smith Legend Privacy Policy
- Initial notice date: September 28, 2026
- Notice of change to the effective date: October 13, 2026
- Effective date: October 13, 2026
mocozi studio, a sole proprietorship operated by Jaehwan Jung (the “Company,” “we,” “us,” or “our”), processes personal information as described below when providing Battle Smith Legend, our official website, and customer support.
You may send privacy inquiries and requests to access, correct, delete, or suspend the processing of your personal information to support@mocozistudio.com.
1. Information We Collect and Why We Use It
We process information you provide directly, information received from sign-in and payment services, and information generated when you play the game. The information involved depends on your sign-in method, the features you use, your device settings, and your privacy choices.
| Category | Information processed | Purpose |
|---|---|---|
| Account and sign-in | Game account identifier (UID), sign-in provider and account identifiers, email address if provided, account creation and sign-in information | Identifying your account, sign-in, account linking, and account management |
| Gameplay | Display name and in-game display ID, progress, items, currency and entitlements, purchase, usage and reward history, game settings, and save and connection information | Saving progress, providing content, using the same account across devices, and customer support |
| Rankings | Display name and display ID, rank and achievement records, and appearance information shown in rankings, such as costumes and pets | Calculating rankings and providing public leaderboards |
| Purchases and payments | Account, store, product, order and transaction identifiers; purchase tokens, receipts and verification results; purchase time and status; amounts, currencies and transaction regions if provided; delivery and usage records | Verifying purchases, delivering products, preventing duplicate delivery, handling refunds and disputes, and retaining legally required records |
| Acceptance records and privacy requests | Documents accepted, their versions and languages, and acceptance times; account, app, platform and installation identifiers; collection suspension settings and application results; identifiers used to request deletion of analytics data | Maintaining acceptance records, applying your choices, and handling rights requests |
| Analytics | Analytics identifiers such as app instance identifiers; app launch, gameplay, purchase and advertising events; device, operating system, app version and language; approximate location inferred from IP addresses | Analyzing usage, game balance and performance, improving the service, and analyzing advertising performance |
| Errors and security | Error and crash records, diagnostic logs, device, operating system and app version, installation, account and request identifiers, server request times, processing results and connection IP addresses | Resolving errors, maintaining service stability and security, and investigating misuse |
| Advertising | Advertising identifiers where permitted (AAID and IDFA), app, device and installation information, IP addresses and approximate location, ad requests, impressions, clicks, views and rewards, diagnostic information and privacy choice status | Serving, measuring and settling payments for ads, providing personalized ads where permitted, and preventing advertising fraud |
| Configuration and website | Firebase installation identifiers needed to retrieve settings, and network information such as IP addresses when accessing the official website | Delivering game configuration and providing and hosting web pages |
| Customer support | Email address, inquiry content, account and transaction information and attachments you provide, and identity verification and request handling records | Answering inquiries, resolving account and purchase issues, and handling rights requests and disputes |
Guest players are also assigned an identifier used to save game data. If you use Apple's Hide My Email feature, a private relay address may be provided instead of your actual email address.
We do not directly ask you to enter your Google or Apple account password or full payment card number. We do not request precise GPS location, but your approximate location may be inferred from your IP address. Do not send passwords, sign-in verification codes, resident registration numbers, or full payment card numbers when contacting us.
2. Processing Your Information and Your Choices
We process information needed for sign-in, saving game data, delivering purchased products, and providing customer support you request to enter into and perform our service agreement with you. We retain legally required transaction records in accordance with applicable law.
Where separate consent is required, we explain the purposes, information involved, retention period, and consequences of refusing consent, and obtain that consent. Accepting our Terms of Service or acknowledging this Policy is not treated as consent to all processing of personal information.
Sections 7 and 8 explain advertising choices and how to request that analytics collection or automatic error reporting stop. Refusing optional processing does not restrict gameplay unrelated to that processing. If stopping the processing of essential information would prevent us from providing a feature, we explain the affected feature and the reason.
3. Retention Periods
We follow the retention periods and deletion criteria below for each type of information. Once the purpose of retention has been fulfilled and the information is no longer needed, we destroy it without delay, except where retention is required by applicable law or another applicable exception permits retention.
| Information | Retention period and deletion criteria |
|---|---|
| Account and ordinary game data, including acceptance records and privacy settings stored in the account | For the duration of account use. After the 30-day cancellation period following an account deletion request, the data is deleted through our scheduled deletion process. Minimum records subject to statutory retention or other exceptions below are retained separately under the applicable criteria. |
| Records of contracts, withdrawal from purchases, payments, and supply of content | Minimum necessary records retained separately for 5 years under the Republic of Korea's Act on the Consumer Protection in Electronic Commerce, Etc. and its Enforcement Decree |
| Consumer complaint and dispute handling records | 3 years under the same Act and its Enforcement Decree |
| Records of the Company's commercial representations and advertisements | 6 months under the same Act and its Enforcement Decree. This is not the retention period for all ad-viewing logs. |
| Other general inquiries | For as long as necessary to handle the inquiry and follow-up support, up to 3 years after handling is completed. Inquiries and attachments that are no longer needed are deleted earlier. |
| Analytics user-level and event-level information | 2 months for event data and 14 months for user data. New activity may reset the user retention period. Aggregate reports are handled separately. |
| Crashlytics error records and related identifiers | Under the provider's policy, deletion from live and backup systems begins after 90 days. |
| Records preventing ranking entries from being recreated after account deletion | Until account deletion is complete and the risk that earlier tasks could recreate ranking entries has been resolved |
| Records preventing duplicate delivery of purchases | Only minimum transaction and account attribution information is retained for as long as needed to prevent the same transaction from being fulfilled again. It is deleted when repeat delivery is no longer possible or service closure ends the purpose. |
| Misuse investigation and appeal records | Deleted or rendered non-identifiable when the investigation, appeal handling and necessary follow-up actions are complete and the retention purpose has ended |
| Cloud Logging operational and error logs / required audit logs | 30 days / 400 days, respectively. These periods apply to the relevant log storage, not to all game data. |
Information needed for statutory retention or an ongoing dispute is retained separately only within the relevant scope and period. We distinguish acceptance records that qualify as legally required contract records from ordinary settings; not all privacy settings are retained for 5 years. Retaining records to prevent duplicate purchase delivery does not mean retaining all game data, and is separate from the 5-year statutory retention of transaction records.
4. Account Closure and Deletion
You may request account deletion using the in-game account deletion feature, or contact customer support if you cannot access the game. You may cancel your account deletion request within 30 days of submitting it. After that period, we delete the game account used to sign in and ordinary game data through our scheduled deletion process. Records preventing ranking entries from being recreated and records retained separately are handled as described in Section 3.
Electronic records due for destruction are deleted so that they cannot be recovered or reproduced. If information is retained for statistical or similar purposes, it is processed into a form that does not identify an individual even when combined with other information. Personal information that must be retained by law is kept separately from other information with restricted access. Any paper records are destroyed by shredding or similar means. Provider deletion cycles may apply to live cloud systems and backups.
Closing your game account does not delete your Google or Apple account or your store purchase history. Deletion of analytics and error information already transmitted follows the request process in Section 8 and the relevant service's retention and deletion rules.
5. Service Providers and External Services
We use the following services. Where we entrust processing to a provider, we apply the personal information protection obligations and oversight required by applicable law. Where an external provider, such as an advertising provider, processes information for its own purposes and under its own responsibility, its privacy policy also applies to that processing.
| Provider and service | Functions and processing purposes |
|---|---|
| Google Cloud Korea LLC — Google Cloud and paid Firebase services | Account authentication, game data storage, server functions, operations and security |
| Google Asia Pacific Pte. Ltd. — Firebase Crashlytics | Error and crash diagnostics |
| Google LLC — Firebase Remote Config | Delivering game configuration |
| Google LLC — Google Analytics for Firebase | Usage and advertising performance analytics |
| Google Asia Pacific Pte. Ltd. — Google AdMob | Ad serving, mediation, measurement and fraud prevention |
| Unity Technologies S.F. — Unity Ads | Ad serving, measurement and fraud prevention through AdMob mediation |
| Netlify, Inc. | Hosting our official website and terms and policy pages |
| Microsoft 365 supplied through GoDaddy | Receiving, storing and replying to customer support emails |
| Google and Apple sign-in services and app stores | Your chosen sign-in method, app distribution, payments and purchase verification |
We obtain separate consent for disclosures to third parties where consent is required, and respond to requests made under law only to the extent permitted. Your display name, in-game display ID, rank, achievement records and appearance information shown in rankings, such as costumes and pets, may be visible to other users on in-game leaderboards. Emails, receipts and inquiry content are not displayed on public leaderboards.
Provider information: Firebase, Google and information from partner apps, Unity, Apple, Netlify, Microsoft, and GoDaddy.
6. International Transfers
When external services are used, personal information may be processed or stored outside the Republic of Korea, or accessed from abroad. Information is transmitted over networks when the relevant features are used, data is synchronized, errors are reported, or ads are requested or interacted with.
| Service | Storage and processing locations | Information and purpose | Retention and deletion |
|---|---|---|---|
| Firebase Authentication | United States | Account, authentication, email and authentication connection information / sign-in and account management | Retained until we request deletion of the relevant game account from Firebase. Removal from live and backup systems may take up to 180 days after our request; authentication IP logs are retained for a few weeks. |
| Firebase Realtime Database | Database configured in Singapore | Account identifiers, game state and rankings / storage and synchronization | Retention and deletion criteria in Sections 3 and 4 |
| Firebase Crashlytics | Google's global processing infrastructure | Error and identifier information in Section 1 / diagnostics | Deletion begins after 90 days. |
| Firebase Remote Config | Google's global processing infrastructure | Installation identifiers and related information / configuration delivery | Retained until we request deletion of the installation identifier from Firebase, with removal taking up to 180 days after our request. This is separate from game account deletion. |
| Google Analytics | Google's global processing infrastructure, including the United States | Analytics information in Section 1 / usage and advertising performance analytics | User and event retention settings in Section 3 |
| Google AdMob | Google's global processing infrastructure | Advertising information in Section 1 / advertising, measurement and fraud prevention | Google's retention criteria based on the information type and service delivery, legal compliance and security purposes |
| Unity Ads | United States and countries where Unity and its service providers operate processing facilities | Advertising information in Section 1 / advertising, measurement and fraud prevention | For as long as necessary to provide the service, comply with legal obligations, handle disputes and protect rights |
The maximum 180-day periods in the table begin when we submit the relevant deletion request to Firebase, not when you contact us or request account closure. They are the provider's deletion periods. The Korean contracting entity listed in Section 5 may differ from the actual overseas infrastructure operator. Configuring Firestore or Cloud Functions in a Korean region is also distinct from the possibility of overseas support or access. Website hosting and support email are subject to the processing facilities and subprocessor arrangements of Netlify and Microsoft 365/GoDaddy.
Further information is available from Firebase, Google Cloud's subprocessors, Google's international processing information, and the provider policies linked in Section 5. Privacy contacts include Google at googlekrsupport@google.com, Unity at DPO@unity3d.com, and Netlify at privacy@netlify.com. The Google address is its Korean privacy inquiry contact; product-specific requests may be directed to the relevant support channel.
We follow the legal basis and notice and consent procedures required for international transfers. We distinguish entrusted processing and storage needed to perform our agreement from disclosures requiring separate consent. This Policy does not replace any required consent.
You may request that transfers stop by contacting support@mocozistudio.com. Stopping transfers needed for authentication or saving game data may limit those features. We explain the effects and available options.
7. Advertising and Automatic Collection
SDKs in the game, including Firebase Analytics, Crashlytics, AdMob and Unity Ads, process the app, installation and advertising identifiers, usage information and error information described in Section 1 according to each service's functions.
You can manage advertising choices through the in-game advertising privacy options screen, where displayed for the applicable region and requirements, your device's advertising privacy settings, and iOS tracking permission settings. Ads may still appear if you decline personalized advertising, and doing so does not stop all processing needed for ad delivery, security or measurement.
Declining personalized advertising, using an ad-removal product, and stopping analytics collection or automatic error reporting are separate functions. Non-personalized ads may still appear if you decline personalized advertising. Using an ad-removal product does not also stop analytics collection or automatic error reporting. You may request that analytics collection or automatic error reporting stop through the procedure in Section 8.
8. Requests to Access, Correct or Delete Information or Stop Collection
You and your authorized representative may request access to, correction or deletion of personal information, suspension of processing, or withdrawal of consent.
- Submit a request: Email support@mocozistudio.com with your request, information that can identify the relevant account, such as your in-game display ID, and an email address for our reply. If you cannot access the game or find your account information, explain the situation and we will guide you through the necessary verification steps. Do not send passwords or sign-in verification codes.
- Verification and handling: We use only the minimum information needed to verify your identity or the representative's authority and handle the request within the time limits and procedures required by law.
- Response: We notify you of the result by email. If further verification, statutory retention or another applicable reason limits what we can do, we explain the reason and how to challenge the decision.
You may request that Analytics collection or Crashlytics automatic error reporting stop while continuing to play the game. Receipt of your email and application of the collection setting on your device may occur at different times. After we verify your request and process the suspension setting, applying it on a device may require an update to a supported app version, an internet connection, reconnection, or fully closing and restarting the app. If you use multiple devices, the setting must be applied on each device. We explain the necessary steps and the application results we can verify.
Stopping collection and deleting previously collected information are separate actions. For past Analytics information, we identify the relevant data using analytics identifiers we can verify and submit a deletion request to the provider. If we cannot obtain past identifiers or otherwise identify all relevant data, we explain the scope we can verify. Our response distinguishes submission of a deletion request from actual completion. Past Crashlytics information is handled under that service's procedures and retention rules.
9. Children and Young People
In the Republic of Korea, where consent is required to process the personal information of a child under 14, the consent of the child's legal representative and verification of that consent are required. If we learn that we have processed a child's information without a lawful basis, we take necessary steps, such as stopping collection or deleting the information. Related inquiries may be sent to our customer support email.
In the United States, our operating policy restricts game access for users identified as under 13. Content age ratings, store approval for installation or purchases, and consent to personal information processing are separate requirements.
10. Security Measures
We protect personal information through access restrictions, authentication and permission management, protection of data in transit, and server security settings. We respond to security risks and provide notifications and reports required by law if a data breach or similar incident occurs.
11. Rights of Users Outside Korea
Depending on the laws of your country or region of residence, you may have rights to obtain a copy of your information, data portability, restriction of or objection to processing, stopping use for certain advertising purposes, or challenging a decision. You may submit requests through the email process in Section 8. We will not unlawfully disadvantage you for exercising your rights. This Policy does not limit your applicable statutory rights.
12. Privacy Officer and Contact Information
- Business: mocozi studio
- Privacy Officer: Jaehwan Jung
- Email: support@mocozistudio.com
- Address: Unit a148, 34, Suji-ro 342beon-gil, Suji-gu, Yongin-si, Gyeonggi-do, Republic of Korea
The Korean Privacy Portal also provides guidance on exercising rights and responding to privacy violations. In the Republic of Korea, you may seek advice, report a privacy violation or request dispute mediation through the Personal Information Infringement Report Center (118, without an area code) or the Personal Information Dispute Mediation Committee (1833-6972). You may also use the consultation, complaint and dispute resolution procedures of other supervisory authorities applicable to you.
13. Changes to This Policy
To describe our current personal information processing in connection with the launch of our overseas service, we change the effective date of this Policy to October 13, 2026. This is separate from October 28, 2026, when the revised Terms of Service apply to existing users.
When we change this Policy, we announce the changes, reasons and effective date on our official website and through in-app notices where needed. If separate consent is required, we follow that process.
If the effective date changes, we retain the original notice history and separately announce the reasons and revised schedule. An amendment to this Policy does not retroactively establish a legal basis or consent needed for processing before it takes effect.