Mystery Pawnshop App Privacy Policy
This policy explains how SECRET A (“we”, operator of XX Makers) handles personal data in the Android app “Mystery Pawnshop” (Korean: 수상한 전당포, package com.mysterypawnshop.app, the “App”). We are the controller of this data. If the Korean and English versions differ, the Korean version prevails for users in Korea.
At a glance
- You sign in with your Google account. We use the email, name and photo that Google sends only to confirm the sign-in and do not store them.
- We do not collect your real name, phone number, date of birth or address, and we never receive payment details such as card numbers.
- We do not sell personal data or share it with third parties. Servers run on Amazon Web Services (AWS); sign-in, device checks, ads and crash reports are handled by Google.
- You can delete your account at any time in My Page → Account → Delete account. If you have uninstalled the App, request deletion here.
1. Data we collect
| Type | Data | How |
|---|---|---|
| Account (required) | Google account ID (stored as an irreversible hash), internal player number, sign-in session (hashed), your server (Asia or Global), sign-up time, last access time | When you sign in with Google. Email, name and profile photo sent by Google are used only to verify the sign-in and are not stored |
| Device check (required) | Google Play Integrity verdict (whether the App was installed from Google Play and runs on a genuine device) and its time | When you create an account or sign in |
| Game records (required) | Shop owner name, in-game currencies, shop level, item / upgrade / sale history, customers met, attendance, collection, mine, gems, charms, showcase and vault records, duel, co-op upgrade and guild records (including guild name and intro), mail and notice reads, name changes, request counts and restrictions used to stop automated play | Created while you play. You write your name and guild intro yourself |
| Ad rewards (optional) | Ad slot, one-time reward ID, ad transaction ID reported by Google, time of reward | When you finish watching a rewarded ad |
| Invites (optional) | Invite code, inviter’s internal player number, invite reward progress | When you install through an invite link (Google Play install referrer) or enter a code |
| Reports and blocks (optional) | Who you reported, the reason and time; players you blocked | When you report or block |
| Feedback (optional) | Category and message (up to 500 characters), shop owner name, app version, last 3 screens visited, screen size, device model and OS version, a keyed hash of your IP address | When you send feedback. We do not store the IP address itself |
| Crash reports (automatic) | Error details, app version, device model and OS version, a per-installation identifier | Automatically on a crash (Firebase Crashlytics) |
| Server logs (automatic) | IP address, access time, requested URL, app version, errors | Recorded by our server when you use the App |
| Support (optional) | Email address and message | When you email us |
Data collected directly by Google AdMob is described in 5. Service providers and international transfers and 9. Advertising.
We do not collect: real name, phone number, date of birth, address, payment information, precise location, contacts, photos or sensitive data. We receive your email address only if you contact us.
2. Why we use it (and legal bases)
- Running your account and the game — saving progress, continuing on a new device with the same Google account, rankings, duels, guilds, co-op upgrades and the vault (performance of our contract with you).
- Preventing fraud and abuse — checking for tampered apps or devices, automated play, spam, exploits, and repeated sign-up to claim rewards again (our legitimate interests).
- Rewards — paying attendance, ad and invite rewards and preventing double claims (contract).
- Handling reports — reviewing and acting on inappropriate names or intros (legitimate interests and legal obligations).
- Fixing bugs and answering feedback or support requests (legitimate interests).
- Showing ads — Google AdMob ads keep the App free. Personalized ads in the EEA, UK and Switzerland are shown only with your consent.
3. How long we keep it
| Data | Retention |
|---|---|
| Account, game records, ad rewards, invites, reports, blocks, feedback | Until you delete your account, then deleted immediately. Feedback is also deleted 90 days after it is sent |
| Google account ID (hashed) | One year after account deletion, only to stop repeated sign-up for rewards |
| Crash reports | 90 days |
| Server logs | 3 months (Korean Protection of Communications Secrets Act) |
| Server backups | Up to 30 days, used only for disaster recovery |
| Support emails | One year after the request is closed |
After deletion, a guild you created stays if other members remain (leadership passes to a member), and vault records keep the date and amount with the name replaced by “a shop owner”.
5. Service providers and international transfers
| Amazon Web Services | Cloudflare | ||
|---|---|---|---|
| Company | Amazon Web Services, Inc. · aws.amazon.com/privacy | Google LLC · policies.google.com/privacy | Cloudflare, Inc. · privacyquestions@cloudflare.com |
| Location | Asia server users: Republic of Korea (AWS Seoul region). Global server users: United States (AWS US East) | United States and countries where Google operates data centers | United States and countries where Cloudflare operates data centers |
| Purpose | Hosting, database and backups, server logs | Google sign-in, Play Integrity device checks, AdMob ads and reward verification, Firebase Crashlytics crash reports | Our website (xxm.kr) and forwarding support email |
| Data | All data in section 1 except support emails | Sign-in and device check data; advertising ID, app usage, ad interactions, approximate location (from IP), device data; crash reports | Support emails; website access logs |
| Retention | As in section 3 | Per Google’s policies (crash reports 90 days) | Forwarded immediately; logs per Cloudflare’s policies |
Transfers outside your country are made over encrypted connections as needed to provide the App. Google may also process data for its own purposes, such as personalized advertising, under Google’s Privacy Policy.
6. Your rights
- You can ask to access, correct, delete or restrict the processing of your data, object to processing based on legitimate interests, and receive a copy of your data.
- In the App: change your shop owner name in My Page; delete your account and all records in My Page → Account → Delete account.
- By email: write to hello@xxm.kr with your shop owner name, server and the member code shown in My Page. We will verify your identity and reply within 10 days. See Request account deletion.
- If you are in the EEA, UK or Switzerland you may also complain to your local data protection authority.
- You can also remove the App’s access in your Google Account under “Third-party apps & services”. This does not delete your game account — use Delete account for that.
7. Children
The App is intended for users aged 16 and over. We do not knowingly collect personal data from children under 16 (under 14 in Korea). If we learn that a child has used the App, or a parent asks us, we delete the account without delay.
8. On-device storage and advertising ID
The App does not use cookies. It stores a random sign-in session value, your chosen server and language, sound and tutorial settings, and an invite code (until sign-up) in the App’s own storage on your device.
Google AdMob uses your device’s advertising ID. You can delete it in Android Settings → Google → Ads → Delete advertising ID; you will then see non-personalized ads. Users in the EEA, UK and Switzerland can choose in the consent dialog at first launch and change it any time in My Page → Privacy options. The game works the same either way.
9. Advertising
Google AdMob collects the advertising ID, app usage, ad impressions, clicks and views, and approximate location (from IP address) to serve and measure ads, personalize ads where permitted, and prevent ad fraud. Google processes this data under its own policies. See section 8 to opt out of personalized ads.
10. Security
- All connections use HTTPS.
- We never ask for a password; you sign in with Google.
- Google account IDs and sign-in sessions are stored only as irreversible hashes; IP addresses are stored only as keyed hashes for spam prevention.
- The admin console requires a secret key, and only the operator can access personal data.
- Server keys are kept out of the source code in access-restricted files; backups are encrypted in access-restricted storage.
- Request rate limits protect against automated play and spam.
11. Contact
| Controller | SECRET A (XX Makers) |
|---|---|
| Privacy officer | Seokwon Kim, CEO |
| Email · Phone | hello@xxm.kr · +82-10-3860-9100 |
| Address | 201, 73 Eonnam-gil, Seocho-gu, Seoul, Republic of Korea |
| Business registration no. | 877-04-02691 |
12. Changes
This policy is effective from October 22, 2026. We will announce changes in the App and on this page at least 7 days before they take effect (30 days for important changes).