Privacy policy
Prepared/revised: 16 October 2026 / CAT BEAT service information
This policy explains the information processed for CAT BEAT : Wake the Beat and how to exercise your privacy rights.
1. Scope and processing principles
오늘도 레벨업 (the “Company”) follows applicable Korean privacy law, limits processing to necessary purposes and explains data, retention and rights.
Game progress and settings are stored on the user’s device rather than in a separate company membership database. We do not provide registration requesting names, telephone numbers or addresses. We retain support emails to handle inquiries; Firebase processes installation information when remote announcements are used.
External providers have their own policies without removing our responsibility for actual processing. Reading this notice is not collection or marketing consent.
2. Data categories and collection methods
| Feature | Information | Method/location |
|---|---|---|
| Website delivery | IP address, requested path and communications metadata | Sent with page/media requests. Statistics keep known page IDs and request categories, not raw IP addresses or headers. |
| Website demo | Input, impact and screen progress | Demo state stays in page memory; demo start and first note attack are sent as minimal website-statistics events. |
| Device-local game records | Stages, stars, results, rewards, gold/AP and recovery times, upgrades, daily activity, stamps, owned/equipped skins, preferences, tutorials and video-view flags | Browser local saves, including record IDs, revisions, settlement times and integrity values |
| Notice board | Read notice IDs/revisions/content digests, cached notices and last attempt/success times | Device storage; OS/channel/game version are used for local display eligibility |
| Configured external notices | Firebase installation ID/authentication information, app ID, SDK version, browser language and communications metadata such as IP | Generated, sent and locally cached through Remote Config and Installations |
| Email support | Reply address, message and voluntarily supplied environment, redacted screen or transaction evidence | Submitted by the user and handled in a Gmail mailbox |
| When platform identification is used | Service-specific platform identifier | Retrieved through the SDK in a supported platform environment; this does not provide complete platform member details such as name or telephone number |
| Website visit statistics | Page/resource IDs, temporary page random values, events/time, allowed source categories and link IDs | Website collection API and our statistics store, without raw IPs, search phrases or accounts |
The game has no form collecting names, telephone numbers, addresses or birth dates and no chat, post or audio upload. A Toss identifier does not grant us all Toss profile information.
Do not send passwords, codes, national identification numbers, full card numbers or complete save files. Excess information in support evidence is assessed for redaction or deletion.
3. Purposes, legal grounds and choices
| Processing | Purpose | Grounds/choice |
|---|---|---|
| Device game/preferences | Maintain requested progress, rewards and settings; prevent conflicting saves | Article15(1)4 of the Personal Information Protection Act for processing necessary to perform the service contract. Refusing storage may prevent retaining progress |
| Notices/read convenience | Deliver game information and preserve read status/last valid notices | Processing necessary to provide service notices. Separate consent applies where required or where processing exceeds necessary contract performance |
| Support/rights | Answer questions, investigate issues/disputes and verify necessary authority | Applicable contract-performance or statutory-duty grounds for the particular request |
| Statutory transaction records | Comply with applicable commerce retention | Legal obligation where actual qualifying records exist |
| Future optional events/marketing | Deliver separately requested events or advertising | Required consent and refusal arrangements before introduction; no blanket activation |
New purposes, categories, sharing or international transfers require their actual legal basis and applicable information/consent before activation.
Where separate consent is required for collection, use or an international transfer, we disclose the categories, purpose, period and consequences of refusal and obtain consent. Reading the policy is not consent.
4. Game records and platform identification
Progress, currency, skins and settings are stored on the relevant device or browser. Clearing site data, resetting a device or changing storage environments may remove them. We do not provide automatic backup or cross-device synchronization through a separate company server.
Where platform identification is used, service-specific identifiers are processed only as necessary to distinguish users. An identifier is not treated as fully anonymous merely because it does not contain a real name.
Platform orders/payments and local progress are separate. Deleting device records does not cancel purchases, complete refunds or delete platform records.
5. Firebase notices and installation information
Configured full-game builds fetch public notices with Firebase Remote Config. Installations supplies an installation ID/authentication information; SDK requests include app ID, SDK version and browser language, with technical communications information such as IP also processed.
Our notice request does not add the game user key, gold/AP, skins, individual play or purchases. OS/channel/version eligibility is evaluated locally; read marks are not uploaded to our notice server.
The current game does not connect Analytics event collection, Crashlytics, personalization experiments or FCM-token registration. Project Analytics integration remains enabled, but the optional use of Firebase Service Data for additional analysis, recommendations and improvements of other Google services has been disabled. This does not stop processing needed to provide or secure Firebase services or delete historical data.
The normal successful-fetch interval is twelve hours, with retry limits and SDK caching. This controls request frequency, not personal-data retention. Support, networking and site-data settings affect availability.
6. Retention periods
| Record | Period/basis | Deletion/distinction |
|---|---|---|
| Website-demo state | While the page runs | Ends with the page/session state |
| Local game/preferences | Until site data or its storage environment is cleared | Not an automatically expiring server account; browser policies can remove it earlier |
| Notice reads/cache | Until site-data deletion or replacement/pruning | Read convenience history is bounded to 200 entries; the fetch interval is not retention |
| General support inquiries | One year after handling is completed | For follow-up; unnecessary attachments are deleted earlier |
| Firebase installation information | Provider guidance permits retention until its deletion API is invoked | Following a valid deletion request, removal from Google live/backups can take up to 180 days; local clearing is distinct |
| Records where purchase, ad or consent features are provided | Processed for the actual feature, contract and applicable statutory retention period | Distinguish orders/grants/refunds, ad completion and consent. Records for unavailable features are not collected |
An ongoing inquiry’s one-year period starts after resolution. Any additional statutory or legally necessary preservation is justified, limited and separated, not indiscriminately applied to all inquiries.
Firebase deletion needs the SDK/provider process. The game has no one-click installation-erasure menu; progress reset does not claim server erasure. See sections 10 and 13.
7. Statutory preservation
The following applies only where actual commerce/dispute records create the corresponding legal duty; it does not mean the non-paying website already collects transaction records.
| Legal ground | Records | Period |
|---|---|---|
| Korean electronic-commerce law and Enforcement Decree article 6 | Displays/advertisements | 6 months |
| Same | Contracts/withdrawals | 5 years |
| Same | Payments/supply | 5 years |
| Same | Consumer complaints/disputes | 3 years |
Only necessary qualifying records are preserved with unrelated uses restricted. These periods are not applied to every visit or all game progress.
No universal communications-log period is imposed on all businesses or records. Any later applicable hosting/service duty must be specifically assessed and disclosed.
8. Third-party disclosure
We do not sell or disclose information for unrelated purposes without a lawful ground. The website uses its own minimal statistics collector, without an external advertising/analytics SDK.
Notice-service processing and email storage are distinguished below from independent platform processing and actual disclosure by us.
New sharing requires recipients, purposes, fields, periods and legal grounds, with separate consent where required. Legal requests are checked for authority, procedure and scope.
9. Outsourced processing
| External service | Purpose | Processing conditions |
|---|---|---|
| Google LLC — Firebase Remote Config / Installations | Public announcements and installation information | Processed under the applicable Firebase terms and data processing/security conditions. See section10 for international processing |
| Google LLC — Gmail | Receiving, retaining and replying to support/privacy emails | Processing through the general Google service. Company support-record retention and erasure follow sections6 and11 |
Providers are classified by their actual legal role. Where outsourcing applies, contracts and supervision address purposes, safeguards, subprocessing and responsibility, and actual processors/work are disclosed.
Platform privacy policies also apply to membership/payment data processed independently by the platform. If we separately receive and process such data, we disclose its scope and purpose. Changes to processing assignments or providers are disclosed.
10. International processing and choices
We use Google services for game announcements and support emails. Their data categories and retention periods are set out separately below. Our support-mail retention period differs from Google’s installation-data processing period.
| Category | Firebase Remote Config / Installations | Gmail support email |
|---|---|---|
| Recipient/contact | Google LLC is the default provider under the public standard terms. Privacy contact: policies.google.com/privacy | Google LLC is the provider in the Korean general terms. Privacy contact: policies.google.com/privacy |
| Purpose | Public announcement retrieval and installation verification for configured full-game environments | Receiving and replying to requested support and privacy-rights inquiries |
| International processing scope | Google LLC is based in the United States; service information may be processed in global infrastructure in countries where Google or its processors operate facilities | Google LLC is based in the United States; email service information may be processed on Google’s global servers |
| Timing/method | Provider SDK network requests when remote announcements are retrieved | Email transmission and storage when the user sends a support request |
| Data categories | Installation IDs/authentication, app/SDK/language details and communications metadata such as IP address | Submitted reply email, message, attachments and necessary minimum evidence |
| Retention | Installation IDs may remain until a deletion request; provider live/backup cleanup may take up to 180 days after a valid request | Company support records: one year after closure. Actual statutory records are retained separately under section 7 |
| Applicable grounds | Notice under article28-8(1)3 for entrusted processing/storage necessary to perform the service contract; separate consent procedures apply where required | Necessary processing for requested support/privacy rights. Where separate international-processing consent is required, categories, purpose, period and refusal arrangements are disclosed and consent obtained |
Send international-processing inquiries or restriction/erasure requests to leveluptodaystudio@gmail.com. If we do not hold the requested information, we tell you, distinguishing action available to us from necessary external-service procedures.
Users may stop running the remote-fetching game if they do not want further announcement requests. No dedicated opt-out switch is currently available; deleting device records does not also complete external erasure.
Google’s information about processing locations and safeguards is available at firebase.google.com/support/privacy and policies.google.com/privacy. Global processing varies by service; Google LLC’s US location does not mean all information is stored only in that country.
11. Deletion procedures and methods
Unnecessary or expired data is deleted without delay unless law requires preservation. Retained categories, grounds and periods are separated with restricted access/use.
Electronic and paper records are destroyed using appropriate nonrecoverable deletion or shredding methods. Expired support messages and unnecessary attachments are included.
Local records are removed through device/browser site-data controls. We explain procedures without falsely confirming inaccessible device erasure.
Firebase server-side installation deletion requires its own API/provider process. Official guidance permits up to 180 days for live/backup removal; running ID-generating services again can create new information. The game has no automatic/one-click deletion facility; each request’s target and feasible actions are explained.
12. Rights, verification and objections
Users and lawful representatives may exercise applicable access, correction, erasure, restriction, withdrawal and other rights by emailing leveluptodaystudio@gmail.com.
Identify the service/data, desired action and reply route. Only necessary identity/authority evidence is requested, never passwords or codes; lawful representatives may need authorization evidence.
If we do not hold the requested information, we explain that fact. For game records stored only on your device, we explain how to delete them. For information we retain, such as support emails, we erase it under applicable law or explain the required retention basis and period. For information processed through external services, we determine the action available to us and explain any steps needed from you.
Access and other requests follow their statutory deadlines. Any deferred or refused access is notified with reasons and an objection route within ten days where required by Korean law.
Lawful retention or third-party rights can justify limited restrictions, with grounds, scope, alternatives and objections explained rather than categorical refusal of every request.
Reconsideration and independent remedies remain available. Local erasure, platform disconnection, Firebase installation deletion and refunds have different effects.
The policy index provides copyable forms in Refund and privacy requests. Guardian or representative requests require only necessary authority verification; a full identity-document copy is not required for every request.
13. Cookies, browser storage and controls
The footer statistics control stops further browser events for that tab. Only this preference is stored in sessionStorage; no tracking cookie or persistent returning-visitor ID is set. DNT or GPC disables events by default. Disabling JavaScript prevents browser events. These controls do not block static page requests or hosting security logs. Questions about received statistics and privacy rights go to leveluptodaystudio@gmail.com.
The game stores saves, preferences, read status and notice caches locally. Firebase may use IndexedDB or supported browser stores for installation and remote-configuration data; this is not omitted merely because the website has no cookies.
Browser privacy/site-data settings can delete or block the relevant site’s storage and cookies; exact controls vary by version and OS.
Blocking storage can prevent persistence or functionality. Deletion can irreversibly remove local progress and is not server/provider erasure. Check actual browser/platform behavior for private mode and app removal.
14. Advertising, behavioral information and analytics
Website statistics store known page/resource IDs, a new random value for each page execution, view/play/download/tool/demo event types, receipt time, allow-listed campaigns and source categories. A signed link valid for two minutes connects movement between the two websites. The statistics store does not keep raw IP addresses or user agents, search phrases, full referrer URLs, names, email addresses, accounts or full-game saves. Servers and hosting providers still process IP addresses and headers in transit.
Statistics are used to understand content use and movement between the sites and improve the service and resources. Raw events are retained for the current UTC date and six preceding dates, with hourly cleanup. Daily counts without page random values or link IDs are retained for the current date and 89 preceding dates. Local previews and review traffic are marked as tests.
The footer statistics control stops further browser events for that tab. Only this preference is stored in sessionStorage; no tracking cookie or persistent returning-visitor ID is set. DNT or GPC disables events by default. Disabling JavaScript prevents browser events. These controls do not block static page requests or hosting security logs. Questions about received statistics and privacy rights go to leveluptodaystudio@gmail.com.
Where rewarded ads are offered, the integrated Toss SDK may use Toss Ads or Google AdMob depending on the environment. Ad delivery/measurement processing follows the actual tool, device settings and permissions. Watching an ad is not blanket consent to personalized advertising or marketing.
Before connecting a new advertising/analytics tool, we disclose the provider, categories, purpose, method, period and refusal controls and obtain consent where legally required. Unrelated optional disclosure is not a condition of basic play.
We apply the principle of not offering personalized ads to known children under14 or collecting their behavioral data for that purpose. Advertising features are offered only within applicable child-protection conditions.
15. Notifications, agreement and withdrawal
Fetching public notices differs from push delivery. Approved Toss purposes/templates are not configured, and the game has no FCM-token registration or Company server sending personalized push.
When offered, purposes/providers, legally required agreement and OS permissions are distinguished. One dialog result is not proof of consent to every future advertisement.
Available platform notifications are managed in Toss/OS settings with actual in-service guidance and support. Refusal does not categorically block unrelated basic gameplay.
16. Children under fourteen and guardians
The service primarily targets users in Korea. Children under14 are subject to the game rating and applicable platform age/guardian conditions. We do not provide registration requesting a child’s name, birth date or guardian contact.
Any consent-based processing of under-fourteen children requires necessary verified guardian consent and understandable information before introduction.
Guardians can exercise applicable rights. Reports of unsupported child-data processing are investigated and addressed with necessary restriction/erasure and a response. Minors’ purchases follow the separate terms procedure.
17. Sensitive data, pseudonymization and automated decisions
There are no inputs for sensitive health/political/biometric data or national identifiers and no surveillance-camera feature. Support requests seek only necessary evidence.
No separate pseudonymized research/analysis is connected. Ordinary rhythm scoring and rewards are not represented as legally significant automated decisions.
Any later applicable processing requires its actual purposes, data, grounds, periods, safeguards and rights of explanation/refusal to be explained.
18. Safeguards and incident response
Safeguards match actual processing: access limits, device/mailbox security, updates, controlled disclosure and deletion, with required provider protections assessed.
Local saves have integrity checks between saves and settlement records. These are not encryption or cloud backup; someone with device access may access local information.
Firebase announcements use the provider SDK’s protected network communications. Security settings and necessary safeguards are managed for the actual service environment.
Confirmed incidents trigger investigation, containment and user/regulatory notifications as required by applicable law.
19. Privacy officer, contact and remedies
Privacy officer: 이시내 (representative).
Privacy inquiries and rights requests: leveluptodaystudio@gmail.com.
No public telephone support line is operated; inquiries and replies use email. General and privacy requests share a mailbox but follow their respective verification, retention and legal deadlines.
Independent guidance/remedies are available through privacy.go.kr, privacy.kisa.or.kr and kopico.go.kr. An internal response is not a prerequisite for available external remedies.
20. Policy changes and application
We announce changes and their application date through the service or website. Ordinary changes are announced 7 days in advance and materially rights-affecting changes 30 days in advance; any required separate-consent procedure also applies.
This text was prepared/revised on 16 October 2026. The effective date and amendment history of the policy actually applied to the service are displayed on publication, and previous effective versions are retained.
Reading this document is not acceptance of terms or consent to personal-data processing.