Privacy policy
Effective date: · Updated:
Controller and purposes
The operator processes information needed for account authentication, saved records, settings and characters, public rankings, abuse prevention, incident handling and support. Processing relies on contract performance, legal obligations or another applicable basis. We provide advance information where separate consent is required.
Information processed
The authentication SDK may process profile information returned by the login provider, such as a display name or email address. Paver Run does not separately store email addresses in game records. Account linking processes your LuckyPang account identifier (UID), authentication status and tokens, and nickname. An account display name may be used to suggest a nickname. Game data includes score, distance, maximum combo, play count, characters and unlock progress, selected character, language, graphics and sound preferences, and inputs, progress state and timing used to validate records. Infrastructure may record IP addresses, browser/device information, request times and errors. Support requests include the sender’s email and message. The game does not separately request dates of birth, national identity numbers or payment details.
Tickets and sponsor stages
The server processes linked ticket balances and refill timestamps, weekly results and rewards, sponsor-view confirmation and run revival status. The operator manages sponsor images, videos, schedules and advertiser-chosen viewing durations. Selecting an advertiser link opens its external site in a new tab. Individual game records and account details are not sent to advertisers. Viewing is optional; after 10–15 seconds of confirmation it allows one revival in that run. Guest trial tickets are stored in the browser. Ticket refill through an external advertising network is not yet available.
Public information and disclosures
Anyone can view ranking nicknames, ranks and score, distance, combo or play count. Account UIDs, email addresses, tokens and private unlock progress are not public ranking fields. Do not put your real name or contact details in a nickname. We do not sell personal data or disclose it to independent third parties except where legally required or otherwise lawfully permitted. Service processors are described below.
Retention and deletion
Linked game information is kept while the account remains active and deleted without undue delay after a verified deletion request or LuckyPang account deletion. LuckyPang account deletion triggers deletion of this game’s member record. Logging out preserves records. Playing again after deletion may create new records. Standard API access and error logs have a default retention of 30 days. Support messages are deleted once the support or rights-request purpose is fulfilled. If law or an ongoing dispute requires retention, we separate the affected data and its basis and period. Electronic data is deleted to prevent recovery; printed material is shredded or similarly destroyed.
Processors and storage
Google LLC provides Firebase and Google Cloud for authentication, hosting, the game database/API and security operations. The designated Cloud Firestore and API region is Seoul, Republic of Korea (asia-northeast3). Firebase Authentication is processed in the United States. Hosting and support infrastructure use Google’s global systems. Support email is forwarded through Spaceship, Inc. and received in Google Gmail. Forwarding processes sender and recipient addresses, message content and attachments to deliver inquiries. Official processing, security and subprocessor information is linked below.
International transfers
For authentication needed to perform the linked-account service contract, identifiers, authentication information, IP addresses and browser information are sent to Google LLC in the United States over encrypted connections during login and authentication requests. Contact: Firebase support, https://firebase.google.com/support. The basis is necessary outsourced processing/storage for contract performance and publication of this notice under Article 28-8(1)(3) of Korea’s Personal Information Protection Act. Google states that authentication IP logs last a few weeks and other authentication data is removed from active/backup systems within 180 days after account deletion is requested. Hosting IP data may last a few months. Technical connection information and support email may also be processed in the United States and other countries hosting Google’s global servers; see the official location list below. You may avoid linking or request deletion/restriction, but account synchronization and rankings require authentication processing. When you send an inquiry, Spaceship, Inc. processes forwarding through US servers before delivery to Google Gmail. This is outsourced processing for support and rights requests; you can choose not to send an email. Messages are deleted when their support purpose is fulfilled. Official Spaceship processing, protection and contact information is linked below.
Browser storage and advertising
The Firebase authentication SDK may use IndexedDB and browser storage to maintain sign-in. Guest settings and personal bests may be saved in the browser; linked game records and settings use the server as their source of truth. Clearing site data removes local information and may also remove sign-in persistence and guest preferences. No advertising SDK or advertising personalization tracking is currently installed. Before adding advertising, we will update this notice and disclose providers, data/cookies, opt-outs and any required consent.
Your rights and children
Users and legal representatives may request access, correction, deletion, restriction of processing and withdrawal of consent. Processing information about children under 14 is subject to legal requirements such as parental consent. If we discover child information processed without required consent, we take steps to verify consent or delete it. Send requests to the privacy contact email at the bottom; we verify only necessary ownership or authority information and respond without undue delay. If a request must be refused or limited, we explain the reason and appeal route.
Security and privacy contact
We use HTTPS, authentication checks, server-side record validation, database access restrictions and controlled administrative access. The privacy officer and contact details are listed at the bottom of this page. You may also seek help from Korea’s Privacy Infringement Report Center (privacy.kisa.or.kr, 118) or Personal Information Dispute Mediation Committee (kopico.go.kr).
Changes
This policy takes effect on October 30, 2026. Material changes, including data fields, processors, transfer locations or advertising, will be announced before they take effect, with separate consent where required.