1.Information we process
Information stored only on your device
The following information is stored on your device to provide app features. Except for the limited summary items separately listed below, the complete save data is not sent to the developer’s server.
- Character statistics, equipment, inventory, skills, quests, battles, and progress
- Shared progress, app language, notification settings, and notice history
- Offline adventure state and rewarded-ad reward processing state
- Limited retry queues and ranking cache for failed server transfers
Information sent to Supabase
The app sends the following information to Supabase for anonymous authentication, rankings, service operation, and usage summaries.
| Category | Data processed |
|---|---|
| Anonymous authentication | Installation-based anonymous user UUID, access token, and refresh token |
| Device and app profile | Country and language codes from the system locale, time zone, Android platform, app version and version code, OS version, manufacturer and model, and last access time |
| Rankings | Character UUID, slot number, character name or nickname, class, level, combat power, and achievement/update time |
| Session and progress summary | Event UUID, end time and reason, active slot, level, combat power, accumulated stages and kills, app version, and device model |
| Network and security | IP address, request time, and security or error logs that may be processed when accessing the service |
The country code is an estimate from the Android system locale, not from GPS or IP geolocation. The app does not request precise location permission.
Character name or nickname, class, level, combat power, rank, and achievement time may be visible to other users. Anonymous user UUIDs, device information, and session records are not displayed in rankings.
Information processed by Google Mobile Ads
The app uses Google Mobile Ads (GMA Next-Gen SDK) and AdMob for banner and rewarded ads. According to Google’s disclosures, the following information may be collected and shared with Google.
- IP address and approximate location inferred from it
- Product interactions such as app launches, taps, and ad or video views
- Diagnostic information such as app start time, hangs, and energy usage
- Android advertising ID, app set ID, and other applicable device or account identifiers
Information we do not intentionally collect
The app does not directly request or intentionally collect:
- Email address, phone number, password, or social account
- GPS-based precise location
- Contacts, call logs, SMS, or MMS
- Photos, videos, audio, or files
- Health, biometric, financial, or payment information
If you include personal information in an email or message to us, we may process it to respond to your inquiry.
2.Purposes of processing
- Creating, maintaining, and authenticating an installation-based anonymous account
- Registering, retrieving, validating, and synchronizing deletion of character rankings
- Checking app versions, delivering notices, responding to errors, and protecting the service
- Aggregating session and progress information for service analysis and improvement
- Providing and measuring banner and rewarded ads and preventing fraud or invalid traffic
- Handling user inquiries and privacy or legal requests
3.Service providers and information sharing
We do not sell personal information. The following providers process information to operate the app.
| Provider | Role and purpose | More information |
|---|---|---|
| Supabase, Inc. | Anonymous authentication, database hosting, APIs, security, and incident response. The current primary region is Seoul, South Korea. | Supabase Privacy |
| Google LLC | Ad delivery and measurement through AdMob/GMA, analytics, fraud prevention, and invalid-traffic prevention. Data may be processed through global infrastructure. | Google Privacy Policy |
Supabase is used as a service provider acting on the developer’s instructions. Information may also be disclosed to authorities where required by law, necessary to protect users, or needed to defend legal rights.
4.Retention and deletion
| Information | Retention period or standard |
|---|---|
| Local game saves and settings | Until you delete app data or uninstall the app |
| Detailed session logs | Up to 30 days after being recorded on the server |
| Daily session aggregates | Up to 90 days from the activity date |
| Anonymous account, profile, and rankings | Until the anonymous account is deleted or the service ends. Direct user deletion is currently being prepared |
| Character ranking | Deleted after the character is deleted and server synchronization succeeds |
| Advertising data | According to Google’s policies and your advertising or consent settings |
| Inquiry content | Until the inquiry or dispute is resolved, or longer where required by law |
5.Your rights and how to make a request
You may request access to, correction of, deletion of, or restriction of your information, or ask us a privacy question.
- Suggested subject
- NULL PLAYING Privacy Request
The app does not identify an anonymous account by email address or legal name. We are preparing in-app verification and account-deletion tools that can safely connect a request to an installation. Until then, access or deletion may be limited if we cannot verify that you are the legitimate user of the relevant anonymous account.
6.Security measures
- HTTPS/TLS for Supabase and Google advertising communications
- Installation-level access control through Supabase Row Level Security
- Only public keys in the app; no administrative service_role key
- Validated ranking writes and least-privilege server functions
- Automatic deletion of detailed logs after 30 days and daily aggregates after 90 days
- Android system backup and device transfer disabled
No internet transmission or electronic storage method can be guaranteed to be completely secure. We continue to review safeguards appropriate to the purposes and risks of processing.
7.Notifications and device permissions
The app uses internet and network-state permissions for network connectivity. Offline-adventure notifications are optional and may require notification permission depending on the Android version. Refusing notifications does not prevent basic gameplay.
Advertising SDKs and Android job schedulers may add permissions to the app manifest. A declared permission does not by itself mean that the developer directly collects all information accessible through that permission.
8.Changes to this policy
We will update this policy when data categories, service providers, retention periods, or methods for exercising rights change. Material changes will be announced in the app or on this page, and the last-updated date will be revised.
9.Privacy contact
- Data controller: 4LTree
- Privacy officer: Jisu Lim
- Email: 4ltree.service@gmail.com
- Public policy URL: https://nullplaying.4ltree.com/privacy/en