Privacy Policy
Effective October 23, 2026
This policy explains how paistra (“we” or the “Service”) handles your personal information. We follow the Personal Information Protection Act of the Republic of Korea, where the Service is operated, and respect the privacy rights you have where you live.
1. What we collect, why, and how long we keep it
| Information | Purpose | Retention |
|---|---|---|
| Email address, password (stored only as a one-way hash), username | Identifying your account, signing in, sending account emails such as email verification, sending comment and reply notifications and weekly stats for your games (you can turn these off anytime), showing who posted games and comments, answering inquiries | Until you delete your account |
| Google or GitHub account ID, name or username, and email address (if you sign in with that service and it shares them) | Social sign-in and account identification. We don’t store your profile photo from these services. | Until you delete your account |
| Email verification link (a random code, stored only as a one-way hash) | Confirming that you own the email address you signed up with | Deleted when used, when a new link is sent, or within about 6 hours after it expires (links expire after 24 hours) |
| Password reset link (a random code, stored only as a one-way hash) | Letting you choose a new password when you forget it | Deleted when used, when a new link is sent, or within about 6 hours after it expires (links expire after 1 hour) |
| Bio, links, and profile photo (optional) | Showing your developer profile | Until you remove them or delete your account |
| Activity: games, posts, and comments you publish; likes and favorites; reports; failed sign-in counts and account lock or ban records | Providing the Service, handling reports, preventing unauthorized sign-in | Until you delete your account |
| Visitor cookie value (a random ID) and view and play records | Counting each visitor’s views and plays once per day | Server records are deleted within 2 days; the cookie stays in your browser for up to 1 year |
| The website domain you came from when opening a game page (domain only — no page path, search terms, or IP address) | Daily totals of where visitors come from, to improve the Service | Kept only as daily counts per domain, which can’t identify you |
| Launch alert (optional): your email address, when you confirmed it, and when we sent the launch email — not linked to an account | Sending you one email when a game we’re making launches | Deleted 24 hours after signing up if you don’t confirm, 30 days after the launch email is sent, or right away when you use the removal link |
| Error reports (error message, page address, browser information — no account or IP address) | Finding and fixing bugs | Deleted 30 days after the bug is fixed, or 90 days after it last happened |
| Access logs (IP address, browser information, date and time, requested URL) | Responding to security incidents, rate limiting, and preventing abuse | Deleted automatically, oldest first, once the server logs exceed a fixed size (30 MB) |
If you’re in the European Economic Area or the United Kingdom, we process this information to provide the Service you signed up for (performance of a contract), for our legitimate interests in keeping the Service secure, preventing abuse, and counting views and plays, and to meet legal obligations.
2. Cookies
We use the following cookies. We don’t use advertising cookies or third-party analytics.
- Visitor cookie (vid): a random value used to count a visitor’s views and plays once per day. Kept in your browser for up to 1 year.
- Sign-in cookie: keeps you signed in. Removed when you sign out or after 14 days.
- Security cookies: protect the sign-in process against request forgery and remember where to take you after you sign in. They expire when you close your browser or finish signing in.
- Sign-up check cookie: remembers for up to 15 minutes that you confirmed your age and agreed to the terms before signing up with a social account.
- Age check cookie: remembers for up to 1 year that you confirmed you’re 18 or older to play a game rated 18+.
You can block or delete cookies in your browser settings (for example, in Chrome under Settings › Privacy and security › Third-party cookies, or in Safari under Settings › Privacy). If you block the sign-in and security cookies you won’t be able to sign in. Blocking the visitor cookie doesn’t limit browsing or playing games.
3. Deletion
- You can delete your account yourself at any time on your Account page. We also delete your information without delay when you ask us to, or when its retention period ends.
- Deleting your account also deletes your games, posts, comments, activity records, and uploaded images.
- Images you replace or remove are deleted automatically. Images that were uploaded but never used are deleted after about a day.
- Electronic files are deleted in a way that can’t be recovered.
- Disaster-recovery backups are kept on our server for up to 8 days and copied to Kakao Cloud Object Storage in the Republic of Korea, where they’re deleted after 30 days.
4. Service providers and international transfers
- The Service runs on servers provided by Kakao Cloud (Kakao Enterprise Corp.), and your information is stored in the Republic of Korea. If you use the Service from another country, your information is transferred to and processed in Korea.
- Account emails, such as email verification, comment notifications, and weekly stats, are sent through Hiworks (Gabia Inc.), whose mail servers are in the Republic of Korea.
- If you sign in with Google or GitHub, that company handles the sign-in under its own privacy policy and shares only the information listed above with us.
5. Sharing
We don’t sell your personal information, and we don’t share it with third parties except when the law requires it. Your username, profile, and the games and comments you publish are public on the Service.
6. Your rights
- You can ask to access, correct, or delete your personal information, or to restrict or stop its processing, and you can withdraw your consent at any time. Depending on where you live, you may also have the right to data portability or to object to processing.
- You can edit your profile, change or reset your password, and delete your account yourself on your Account page. For other requests, contact the privacy officer below.
- We handle requests within 10 days and let you know the result. Deleting your account also deletes your games and comments.
- A legal representative or someone you authorize can also make a request, with a document proving their authority, such as a power of attorney.
7. Age limit
The Service doesn’t accept sign-ups from anyone under 16. We ask you to confirm your age when you sign up, and if we learn that we’ve collected personal information from someone under 16, we delete it without delay.
8. Security
- Passwords are stored with a one-way hash (bcrypt) and can’t be decrypted.
- All traffic is encrypted with HTTPS.
- The database can’t be reached directly from outside our servers.
9. Privacy officer and contact
For questions about your personal information, requests to access, correct, or delete it, or complaints, contact our privacy officer. We’ll respond and act without delay.
- Name: Kim Dong-wook
- Phone: +82-70-8080-2615
- Email: [email protected]
In Korea, you can also report privacy violations to the Personal Information Infringement Report Center (118, privacy.kisa.or.kr) or apply to the Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr). If you’re in the EEA or the UK, you can also complain to your local data protection authority.
10. Changes to this policy
This policy takes effect on October 23, 2026. If we change it, we’ll post the new version and its effective date on this page.