Privacy Policy

1. What we collect

You can play 3moji without a social account. We do not require a real name or phone number, and the app does not request address-book or GPS permissions. Do not put real names, phone numbers or other personal information in your nickname. Connection country codes are processed as described below; we receive an email address only if you link a Google or Apple account.

Game account: a hash of a random ID created on your device (in Apps in Toss, a hash of Toss's anonymous game key), an auto-generated nickname you can change, and your language.

If you link Google or Apple (optional): that provider's account ID and your email address. The email is only used to show which account is linked and is masked on screen. For Apple, we keep Apple's sign-in token encrypted so we can revoke it when you delete your account.

Country: a country code (e.g. US) for country rankings. We do not persist raw IP addresses in our database or request logs. Rate limiting uses temporary IP-derived security keys only in process memory, removed within one minute after their limit window ends.

Game records: scores, the answer chosen for each puzzle and how long it took, and Daily Challenge results.

Progress backup: solved puzzles, personal bests, Daily completion history and up to 366 completed-play dates are stored per account. Accuracy from ranked modes, the Daily and friend challenges (answers, correct answers, first-try correct answers, timeouts and total answer time, by difficulty, clue type, mode, genre, decade and media type) is totaled per account for the Your accuracy screen and deleted with the account. Overall accuracy per puzzle and difficulty is kept only as totals that are not linked to any account. Uploading a personal backup does not submit ranked scores. Personalized and regular practice queues, positions, mistake-review schedules and up to 40 recent practice outcomes used to adjust difficulty are stored on this device and cleared when switching accounts or signing out. We keep up to three regular practice rounds; progress unused for seven days is removed when the app is reopened. Your chosen practice difficulty remains a device preference.

Improvement events (optional, off by default; opt in or withdraw under Settings › Help improve 3moji): random session ID, account ID, language/channel, how you first arrived (utm/referrer), puzzle views, responses, completions, invitations, restores, ad impressions, Remove Ads purchase steps, feedback category and time. They are stored on our own server and the same events are sent to Google Analytics for usage statistics. On the web, Google Analytics cookies (_ga) are used only after both your app analytics choice and the CMP permit analytics. No cookieless analytics requests are sent before permission. The apps contain no Google Analytics SDK; our server sends app events instead. Typed answer text, advertising identifiers and email addresses are never sent.

Friend challenges: anyone with the link can see the inviter's nickname, score and puzzles. When you participate, people who finish that challenge can see your nickname and score on its friends' scoreboard; answer text is not shared. We do not collect contacts or automatically message friends.

Ads: an occasional full-screen ad appears after a game (Google AdMob in the app, Toss in-app ads in Apps in Toss, Google AdSense on the web). When configured, banners labelled "Advertisement" also appear in the app and on the web on results, ranking and explore screens (never during play). We request non-personalized ads only; the ad companies may process device information and advertising identifiers themselves to show ads, cap frequency and prevent fraud. On the web, ad companies including Google may use cookies for this (how Google uses cookies in advertising: https://policies.google.com/technologies/ads). 3moji's servers never receive or store advertising identifiers.

Payments (if you buy Remove Ads): where you paid (App Store, Google Play, Toss or Xsolla), the transaction ID, product, amount, currency and time, stored with your account. Card and other payment details are handled by the payment provider; 3moji never receives them. For web checkout recovery, the browser keeps your account ID, opaque order reference and time for up to 24 hours, cleared on completion or sign-out.

Notifications (optional): Quiz reminder times, days and schedules for new quizzes, saved questions and reviews stay on your device. At most one reminder per selected day is scheduled for the next four weeks and renewed when you open the app. You can turn quiz reminders off in settings. Enabling friend-result alerts stores a device push token linked to your account for up to 30 days after registration; queued messages expire within 24 hours. Expo Push Service, Apple APNs and Google FCM process friend-result notifications. Turning friend alerts off, signing out or deleting your account unregisters the device. Offline removal requests retry when connectivity returns. With analytics consent, up to 1,000 unsent improvement events are held on-device for up to 7 days and deleted on opt-out or sign-out.

2. Why

To grade scores, prevent cheating, provide rankings and friend challenges, restore account progress, verify, restore and refund Remove Ads, and improve puzzles, completion and return visits. Game records are never used to target ads or marketing messages at individuals, and never sold. Traffic sources, campaign results and revenue are only looked at in aggregate.

2-1. Bases by purpose and optional choices

Accounts, scoring, rankings, progress restoration and purchases/refunds you request are processed as necessary to perform the service contract. Security and fraud prevention rely on legitimate interests in protecting the service and players; the balancing assessment and applicable law require operator/counsel review. Statutory transaction records follow applicable retention duties. Where GDPR applies, the contemplated bases are Article 6(1)(b), (f), and (c) only for an applicable EU/Member State legal duty. A Korean retention duty alone is not asserted to establish a GDPR legal obligation.

Optional improvement analytics and analytics cookies rely on consent (GDPR Article 6(1)(a), where applicable). They start off in every region; an old default-on preference is not treated as new consent. Refusal does not prevent quizzes, progress storage or purchases. Your choice is stored on this device and synchronized to the current account's server analytics setting. Signing out or switching accounts turns it off.

Turning off Settings › Help improve 3moji stops new improvement collection and GA transmission and clears this device's pending events and attribution. If offline, server withdrawal takes effect after reconnection. Prior transmissions and statutory transaction records are not retroactively erased; ask the contact below to delete existing analytics. Withdrawal does not affect lawful processing before it. Ad consent is managed separately from this analytics choice.

3. Retention

Detailed answer records for choice-based games are deleted automatically after 90 days. Daily and weekly ranking caches expire a few days after the period ends.

Your account, nickname, personal progress, Daily results and score ledger (account, mode, country, score and time) used to restore rankings are kept until you delete your account.

Apple disconnection: separately from account deletion, we retain only an encrypted token, client ID and job timing for up to 30 days to retry temporary failures. Jobs contain no account ID, email or raw Apple subject; a keyed pseudonymous lookup prevents an old revocation from affecting a new link. Jobs are erased immediately on success. Unfinished jobs are reported as errors and removed at the retention deadline. For legacy accounts without a revocation token, follow the deletion notice and open Apple Account settings → Sign in with Apple → 3moji → Stop Using; support can also help.

Improvement events are kept for up to 90 days and friend challenges for 7 days. Settings can stop improvement events; deleting an account also deletes its events, progress and challenge records.

Financial ledger rows expire five years after the recorded transaction date and expired rows are deleted by a daily job. A verified App Store/Google Play purchase date is used when supplied; legacy records and channels without that date use first verification time. The statutory starting date and legacy date reconciliation require operator/counsel review. Account deletion replaces that account ID in the ledger with a secret-key pseudonym and removes it from the rights holders. Required transaction references and amounts remain until expiry, so this is not anonymization.

To preserve lifetime Remove Ads after financial rows expire, minimal rights state is stored separately: product, status, current holders and a secret-key lookup value of the transaction reference. It supports verified receipt restoration and refund revocation; deleted account links are removed. Full DB backups rotate within 14 daily days and eight weekly weeks (at most 56 days). Pre-deletion data or expired transactions may remain in isolated backups for that window; deletion and expiry must be reapplied before recovery goes live. Long-term financial-only copies omit account IDs and holders and do not extend past five years from the purchase month. Retention grounds, periods and backup exceptions require operator/counsel review.

4. Sharing

Error diagnostics (only when configured by the operator): Sentry (Functional Software, Inc., USA) receives error category/time, scrubbed source positions, app/server build SHA and content version over HTTPS when an error occurs. Raw error messages, answers, request bodies/auth headers, URLs/queries, account IDs/emails, console logs, screenshots and recordings are excluded; native hard-crash collection is disabled. Event-level IP inference is blocked, but network delivery exposes the connecting IP to the recipient's network. Diagnostics is separate from optional usage analytics. Actual processing regions, retention, transfer safeguards and processing basis require operator/counsel review before enabling it; contact section 7.

We do not sell personal data. The providers below process relevant data for service delivery, protection, optional analytics, ads and payments. The service runs on servers we operate, behind Cloudflare's network for protection. Signing in with Google or Apple is handled by those companies under their own privacy policies.

Usage statistics are processed by Google Analytics (Google LLC, USA: account ID, country, language and events, with Google signals and ad personalization turned off; the GA retention setting requires operator confirmation). Ads are served by Google (AdMob, AdSense) and Toss (Viva Republica), and payments are processed by Apple (App Store), Google (Google Play), Toss and Xsolla, each under its own privacy policy. Native ads check the UMP consent result. Web ad scripts load only after a configured Google Privacy & Messaging CMP permits them. If the CMP is unconfigured, fails or denies permission, web ads and web GA are not loaded. Settings › Ad privacy settings reopens the web CMP or native ad consent options.

Cloudflare delivery and connection protection are separate from optional usage analytics. This web build’s browser security policy does not permit external Cloudflare Web Analytics/Browser Insights scripts. The operator must also disable automatic injection in the Cloudflare console and verify actual settings, retention and processing regions. Necessary security/delivery network processing continues.

In Apps in Toss, Speed Quiz scores are also submitted to the Toss Game Center leaderboard.

4-1. International transfers: data, recipients, timing, method and refusal

Optional analytics: Google LLC (Google Analytics, USA) receives account ID, session/client ID, country, language and events via HTTPS when events are sent after consent. Our events last up to 90 days; Google's actual retention must be confirmed in the console/contracts. Refuse or withdraw under Settings › Help improve 3moji and continue playing quizzes.

Connection protection/hosting: our server and Cloudflare, Inc. (USA and global network) process service requests and network information when you connect. Our server's country and Cloudflare's actual processing countries, retention and contracting entity need final confirmation. For permitted optional ad requests, Google (AdMob/AdSense) processes device/ad information over the network; its exact contracting entities, processing countries and retention also need confirmation.

Optional Google/Apple sign-in, friend-result push (Expo, Apple APNs, Google FCM) and payments (Apple, Google, Toss, Xsolla) transmit relevant identifiers, push tokens or transaction information when you use each feature. App/server API connections use HTTPS. The operator must verify each recipient entity, contact, exact processing countries and retention against contracts and consoles. Card details are handled directly by payment providers.

Refuse optional analytics/ads in the settings above and avoid optional sign-in, push or payment features to avoid their transfers. To refuse transfers needed for service connections, request restriction/account deletion at contact@021flow.com and stop using the service. Some features then cannot be provided; statutory transaction retention is an exception.

The transfer basis and safeguards, such as an adequacy decision, Standard Contractual Clauses (SCCs) and any required UK addendum, still require operator/counsel confirmation. We do not assert they have been executed or apply. Request the current transfer inventory, recipient contacts and copies of applicable safeguards at contact@021flow.com.

4-2. Web cookies and CMP

Essential device storage for login, progress, checkout recovery and consent choices is separate from optional analytics/ad cookies. The moji_locale preference cookie stores your selected language for up to one year so the game, landing and static legal pages can preserve it; it contains no account identifier. The web CMP collects consent choices for the EEA, UK and Switzerland; no regional permission is guessed before its determination. TCF data and Consent Mode results are checked, and analytics also needs the separate app analytics choice. Ad personalization remains unrequested.

Reopen choices under Settings › Ad privacy settings or withdraw analytics under Settings › Help improve 3moji. Analytics withdrawal disables GA and attempts to remove default _ga cookies. You can also remove cookies/device storage in your browser. Withdrawing ad permission may reload the page to stop previously loaded third-party code. Web ads/GA remain off until CMP configuration and message publication.

5. Your rights

You can change your nickname in Settings at any time, and request deletion of the service account, records and rankings from Settings › Account › Delete account. Statutory transaction records in section 3 and records held by external providers are exceptions and may need separate requests.

If you linked Google or Apple before removing the app or browser data, sign in with that account to restore backed-up progress. Without a linked account, losing a guest device ID prevents recovery.

5-1. Access, export and complaint process

Under Settings › Account › My game data copy, the signed-in account can view/copy its server-stored profile, progress, personal accuracy and analytics choice as JSON; general web also offers a download. This convenience copy excludes detailed answers, transactions, security/temporary records, device-only records, provider records and isolated backups, and is not a complete response to an access or portability request. Use the contact below for additional scope, rectification, erasure, restriction or other rights. Keep the copy private and clear the clipboard after use.

Request access, a copy, machine-readable export, correction, erasure, restriction, portability, objection or consent withdrawal at contact@021flow.com, stating your request and nickname/account ID. Do not send passwords or national ID numbers. After proportionate identity checks, we respond within applicable statutory deadlines and explain any restriction or extension. You may also object to security processing based on legitimate interests.

You may complain to a supervisory authority independently of contacting us. Korea: https://privacy.kisa.or.kr (118), https://www.privacy.go.kr. EEA: the authority in your place of residence, work or the alleged infringement (directory: https://www.edpb.europa.eu/about-edpb/board/members_en). UK: ICO https://ico.org.uk/make-a-complaint/.

6. Children and general audience

3moji is a general-audience service for movie/TV fans and is not designed for children. We do not collect birth dates, verify every user's age or provide a parental-consent process. We do not knowingly collect personal data from children under 14 or children requiring parental consent in their country. Section 1 still applies: optional social sign-in can provide an email address.

Children and parents should not provide a child's personal information in nicknames, social sign-in or optional analytics. If you learn that a child's data was collected, contact contact@021flow.com. Following minimal necessary verification, we restrict relevant processing and arrange deletion or other necessary action. The ad SDK currently uses general-audience settings; that does not mean users' ages were verified.

7. Who we are and how to reach us

Data controller (operator): Zero to One Flow (021flow), represented by Sungtae Ryu, business registration no. 317-09-03418, A-2704, 25 Beopjo-ro, Yeongtong-gu, Suwon-si, Gyeonggi-do, Republic of Korea

Privacy officer: Sungtae Ryu (contact@021flow.com)

Service support: contact@021flow.com

Requests to access, correct, delete or restrict your data, and any privacy questions: contact@021flow.com. If you cannot use the app, send your nickname or account ID and we will delete the account and its records after verifying it. You may also complain to your local data protection authority.