Privacy Policy

Jellybara is a companion-character game you can start right away as a guest; Apple and Google sign-in are optional and only used to keep your progress. Automatically generated player identifiers are also protected as personal information. We distinguish records stored on your device from information processed on servers.

生效日期 2026-10-03

1. Scope and contact

This policy applies to the Jellybara app and official website, jellybara.com. The data controller is AMINI STUDIO. Privacy matters and rights requests are handled by AMINI STUDIO's privacy contact (representative: Kim Do-min). Operator: 에이미니 스튜디오 (AMINI STUDIO) Representative: 김도민 (Kim Do-min) Business registration number: 385-22-02328 Address: Room 505-S288, 30 Nonhyeon-ro 10-gil, Gangnam-gu, Seoul 06314, Republic of Korea Phone: 010-7295-0752 Mail-order business registration: 2026-Seoul Seocho-2227 (issuing authority: Seocho-gu Office, Seoul) Privacy inquiries, access, correction, and suspension of processing: [email protected] Data deletion requests: [email protected] Service, payment, and general inquiries: [email protected] The policies of stores, linked external services, and payment platforms also apply to information they independently process.

2. Current features and processing grounds

The latest account flow uses Supabase Auth for guest authentication and Apple/Google sign-in. Legacy Unity Gaming Services (UGS) player identifiers may be processed to link and recover existing progress; UGS Remote Config is also used. You may optionally link Apple or Google, or sign in to an existing linked account. Provider identifiers, email addresses supplied by providers, and authentication results are used for linking and recovery; we do not collect Apple or Google passwords. Google Cloud Run and Supabase are used for online game verification and currency records. The app currently offers gem-pack purchases through Unity IAP and online weekly rankings. Optional GA4 behavioral analytics on the public website starts only after separate consent. Firebase Analytics is not yet connected to the app. Optional behavioral analytics is separate from essential payment-SDK operations and diagnostics. Information needed to provide the service is processed to perform the user agreement; optional behavioral analytics is based on consent; legally required retention is based on applicable statutory obligations.

3. Device storage and game operations

Your device stores an automatic player ID, nickname, settings such as sound and haptics, bonding progress, and discovery records. Bonding progress and discovery records are not currently backed up to the cloud. When online, Supabase Auth processes account identifiers and authentication sessions. Legacy UGS Player IDs and nicknames may be used for compatibility and account migration. Remote Config requests use information such as IP addresses, per-installation identifiers, and Player IDs. Basic device and app information and approximate IP-based region information may be used to deliver settings. Purposes include distinguishing players, retaining nicknames, providing announcements and compatible-version settings, and operating the service. Precise GPS location is not requested. Online minigame inputs, mode, score, duration and server-issued run identifiers are verified on Cloud Run. Supabase stores player mappings, run and settlement results, currency balances and changes. Input payloads are used for server verification. Evidence from runs requiring review, such as failed verification, may be retained in the database to investigate errors and recover valid rewards. Inventory, progress, purchase and analytics structures only receive data from features actually connected. Weekly global rankings and personal best records are processed separately; resetting weekly standings does not remove personal best records. Public rankings may show nicknames, scores and positions. Do not put real names or contact details in nicknames. Letters sent through “Write to the developer” in the app — their type (praise, suggestion, bug), text and one optional photo (resized in the app with location data removed, then stored in a private bucket) — together with the app version, device type, operating system, language and display ID sent with them, our replies, and read/claim records for mailbox notices and gifts are stored in Supabase. The purposes are answering inquiries, checking errors and delivering gifts. Letters are seen only by the operators and are never shown to other users. Please do not include your real name, contact details or other unnecessary personal information in letters.

4. Payments and purchase entitlements

Paid content (gem packs) uses Unity IAP, which connects to Apple App Store or Google Play payments. To verify purchases, deliver and restore content, reflect refunds, and prevent duplicate delivery, we may process product IDs, transaction identifiers, receipts or purchase tokens, purchase and refund status, and the player's purchase entitlements. Server verification and entitlement management are linked to Supabase account and game player identifiers and Cloud Run/Supabase game records. Jellybara does not directly collect or retain full payment-method details such as card numbers or bank account information. Payment platforms handle these under their policies. If you do not make a purchase, purchase-verification information is not generated. Test purchases from Apple and Google (TestFlight, app review, and license testers) are recorded separately from real payments. Pending processing and retry history are retained for recovery. Refunded gems are recovered only up to the remaining balance; any shortfall is recorded for operator review, without automatically banning the account or deducting from future top-ups. The Unity IAP SDK may process player, installation and session identifiers, device information and country, crash logs, diagnostics and performance information to operate and diagnose the payment service. This essential SDK processing is separate from purchase decisions and optional web-analytics consent, and does not stop when optional GA4 analytics is refused. It is not used for ad personalization.

5. Optional behavioral analytics

The public website uses Google Analytics 4 (GA4) only with optional consent. It processes page visits and sessions, character-demo loading and interactions, game-page and article-link use, web analytics identifiers, browser and operating-system versions, device type, language and approximate region. The purpose is to understand and improve usage flows, return visits and usability. Firebase Analytics is not yet connected to the app, so app behavioral events are not sent. Before introducing app analytics, we will explain its data categories and consent and withdrawal controls. Analytics events do not include nicknames, email addresses, inquiry contents, raw purchase receipts, or full UGS Player IDs. Ad personalization, Google Signals, advertising-account linking, and advertising-identifier collection are outside this analytics policy's scope. You may refuse or withdraw consent through Analytics settings on the website. Refusal does not prevent access to web content or basic play. Before consent and after refusal, we do not load the GA4 tag or send behavioral events. Withdrawal stops subsequent collection and deletes this website's GA4 cookies. Deletion of previously collected server data may be requested separately at [email protected].

6. Website, cookies, and inquiries

The public website uses Next.js, 3D character presentation and Markdown articles. Visiting it alone does not transmit app Player IDs or progress. Public visitor registration, comments and post uploads are not offered. Supabase use by the game server is separate from public website visits. The website uses cookies storing GA4 analytics identifiers only after optional consent. Your consent or refusal is kept in browser local storage for later visits and can be changed through Analytics settings. Browser settings can also delete or block cookies and local storage. Without consent, analytics cookies are not installed. If you contact us by email, your sender address, display name, message, and attachments you provide are used to receive and answer the inquiry and resolve issues. Do not send passwords, authentication tokens, identity documents, or full card numbers.

7. Retention and deletion

On-device records: retained until app data is deleted. Some copies may remain or be restored through operating-system app archiving, backup, or restoration features. Game accounts and server records: Supabase account identifiers, linked sign-ins (Apple, Google), legacy UGS Player IDs, nicknames, and the gameplay, currency, inventory and progress records stored in Supabase are retained while the account exists. When you delete your account in the app, the records of every Jellybara game used with that account and the sign-in account itself are deleted immediately, with no grace period. Deletion requests received by email are carried out to the same extent without undue delay after verification. Uninstalling the app alone does not send a deletion request to the server. Remote Config states that it does not retain personal information used to process requests. Optional web analytics: GA4 user- and event-level retention is two months, without resetting user-data retention on new activity. Web analytics cookies expire after 60 days without renewing on each visit. This differs from aggregated statistics not subject to the setting and Google's separate processing or backup-deletion schedules. No Firebase behavioral analytics data is stored for the app. Unity IAP: Unity states that service logs are retained for 90 days. Orders and other service data are subject to deletion requests and applicable statutory retention. To request deletion of IAP personal data held by Unity, contact [email protected]; our team will follow Unity's deletion procedure. General inquiries: email inquiries are deleted within one year after resolution. Letters and photos sent in the app and our replies are kept for three years after resolution, following the retention rule for consumer complaint and dispute records, and are deleted immediately if you delete your account. Mailbox read/claim records and gift delivery history are kept while the account exists. As evidence of an account deletion, only a random account number, the deletion time and the number of deleted records are kept for one year, with no name, email or sign-in information. For legacy (UGS) guest accounts, the automatic ID is kept for one year after deletion only to prevent the same records from being recreated. For transactions subject to statutory retention, only the necessary records are kept separately. Under the Republic of Korea's Electronic Commerce Act, where applicable, contract and withdrawal records and payment and supply records are retained for five years, consumer complaint and dispute records for three years, and labeling and advertising records for six months. After an account is deleted, only payment and refund records (store transaction numbers, products, purchase, delivery and refund times and quantities) are kept with the account and sign-in identifiers removed, under restricted access, and are not used for any other purpose. They are deleted when the legal period ends. Electronic files are deleted in a manner that makes recovery difficult; paper records, if any, are shredded.

8. Processors, external services, and overseas processing

UGS and Unity IAP service processing is entrusted to service entities in the Unity Technologies group. Unity's privacy contact is [email protected]. Online authentication, settings requests and payment-SDK use transmit the identifiers, purchase and diagnostic information described above over encrypted connections. Purposes and retention periods are described above. Unity's published subprocessing locations for the relevant services include the United States, Australia, Belgium, Brazil, Germany, Singapore and Taiwan. This does not mean all data is stored in all of these countries. For web GA4, Google LLC and other Google service entities process consented analytics information. It may be transferred over the internet to Google's processing facilities in the United States and elsewhere. Before collection, the consent screen identifies recipients, processing countries, data categories, retention and refusal controls. Firebase Analytics is not yet connected to the app. Google's contact channels are available in its privacy policy linked below. Overseas outsourcing and storage for essential services rely on performance of the user agreement and notice requirements where permitted by applicable law. Transfers requiring separate consent will occur only after obtaining it. Refusing optional behavioral analytics prevents transmission of that analytics information. To object to or stop essential online processing, contact [email protected]; this may restrict online profiles, rankings, purchase verification, or related services. We do not sell information or disclose it for a third party's independent purposes without processing under this policy, separate user consent, or a legal basis. Before introducing a new data-processing service, we will disclose the actual data, processors, and overseas transfers and obtain necessary consent. The game verification server uses Google Cloud Run and the database uses Supabase Pte. Ltd.; both deployments are configured in Seoul, Republic of Korea. Encrypted requests carry authenticated player identifiers and the game records described above. Provider support and subprocessing may occur elsewhere; Seoul deployment does not mean every ancillary operation is domestic. Purposes and retention follow the sections above.

9. Access, correction, deletion, and choices

You can delete your account immediately at any time in the app under My page → Account & sign-in → Delete account. Before deletion we show the currency, items and records that will be removed, and accounts linked to Apple or Google are verified by signing in again with the same account. Deletion takes effect right away and cannot be undone. If Sign in with Apple is linked, the Apple sign-in connection is also revoked. If purchased gems are still being delivered, you can delete after delivery completes. If you have already removed the app or cannot delete in the app, follow https://jellybara.com/delete-account and send a request to [email protected]. No reinstall or sign-in is needed, and you must send the email to submit a request. After verification we delete to the same extent as in-app deletion without undue delay and reply when it is complete. Including the Player ID copied from Account management helps us find the account. A public nickname or Player ID alone does not prove ownership; we may ask for minimal additional verification so we do not delete someone else's records, never passwords or authentication secrets. Access, correction, suspension and withdrawal of consent can be requested at [email protected]; we reply within the periods required by applicable law with the outcome, reasons for any limitation and further procedures. For legally retained records, we explain the basis and remaining period and do not use them for other purposes. Deleting your account also deletes your remaining currency, which cannot be recovered, so please request any refund from [email protected] or the store you paid through before deleting. This does not limit refund rights under applicable law. Deleting your account in the app also removes that account's records on the device; copies in operating-system backups must be deleted on the device. We do not disadvantage users for privacy requests.

10. Children, young people, and security

Jellybara is intended for users aged 14 and older and is not intended for use by, or collection of personal information from, children under 14. We do not knowingly collect personal information from children requiring legal-representative consent without verifying consent under applicable law. If we learn that a child's information was processed without required consent, we stop the relevant processing and take necessary verification and deletion measures. Guardians may contact [email protected] or [email protected]. Processing permissions are limited to what is needed for work. Reasonable safeguards include encryption in transit and access management. Users are also encouraged to lock shared devices and avoid personal information in nicknames.

11. Policy changes and remedies

If this policy changes, the effective date and changes will be announced in the app or on the website. Changes affecting user choices, including purposes, data categories, or recipients, will be announced before application, with renewed consent where legally required. This policy is not blanket consent to personal-information collection. Privacy matters not resolved by our response may be referred to the privacy supervisory or dispute-resolution authority with jurisdiction where you live. Users in the Republic of Korea may contact the Personal Information Infringement Report Center (privacy.kisa.or.kr) or the Personal Information Dispute Mediation Committee (kopico.go.kr).