Privacy Policy

1What we collect

All visitors

• A random identifier created for each visitor (stored in this browser) and how many times you have visited
• Country, region, city and time zone estimated from your IP address (the IP address itself is not kept)
• Where you came from: the referring site, the search engine and any utm values on a campaign link
• Operating system and browser type (version numbers and the raw string are not kept), screen width range and language
• The pages you viewed and in what order, plus time on each page, scroll depth and the names of features you used
• When you finish a run of Bag of Fate, a record of that run (character, bag, battle results and the order of your choices)

Members

• Email address and nickname
• Login records: a hash of each login session and when it was created and last used
• How you signed up: the path you first arrived by, the page where you signed up, and your region and device type at the time
• When you confirmed you are 14 or older and agreed to the collection and use of personal information, which version of this policy you agreed to, and whether you opted in to news emails
• If you log in with Google, Naver or Kakao, the unique account ID that service provides

While you are logged in, that browser's visit records and game run records are linked to your account. Visits that browser made before you logged in are linked too.

If you request a login code

• Your email address and a hash of your IP address used to limit requests (the IP address itself is not stored); both are deleted with the code after one day

If you post in the guestbook

• The name and message you wrote, and a hash of your IP address used against spam and for blocking (the IP address itself is not stored)

What we don't collect

• Text, photos and files you put into the tools: the tools run inside this browser and their contents are never sent to the server
• Your raw IP address and browser string (User-Agent), or a precise location such as GPS
• Passwords: you log in with a one-time code sent by email

2How we use it

• Member features: logging in, showing your nickname, and account features such as game rankings
• Running and improving the site: finding popular features and the pages where people leave, and spotting browsers that break
• Traffic analysis: seeing which routes bring visits that stay longer and lead to sign-ups
• Preventing abuse: limiting code requests and login attempts, and filtering automated traffic
• News emails: news about features and events is sent only to members who separately agreed to receive it

We never sell the information or hand it to advertising companies.

3How long we keep it

• Member information: until you delete your account
• Visit records: 180 days
• Game run records: 1 year
• Login codes: one day; login sessions: 30 days after last use
• Guestbook posts: until deleted (send deletion requests to the contact below)
• IP address hashes on the guestbook block list: until the block is lifted

Records past their retention period are deleted automatically every day.

When you delete your account, the account and its login records are deleted immediately. Visit and game run records are unlinked from the account and given a new visitor identifier, so they remain as statistics that can no longer be tied to anyone. The visitor identifier stored in the browser you used is deleted too.

Exception: if an account is deleted while suspended, only a hash of its email address (the address itself is not stored) is kept for one year to stop the same email from signing up again.

4Processors and transfers abroad

We use the companies below to run the site. Both are in the United States, so information is transferred abroad.

Cloudflare, Inc. (United States)

Hosting the website and database: everything listed in section 1 is transferred over the network whenever you use the site and stored for the periods in section 3.

Resend (Plus Five Five, Inc., United States)

Sending login code emails: your email address and the message (the code) are transferred each time you request a code.

The weather in the sidebar and the map on the internet speed test page are fetched by your browser directly, without going through this site: ipapi.co (location estimate), bigdatacloud.net (city name), open-meteo.com (weather and air quality) and openstreetmap.org (map). Those services receive your IP address when this happens. This site does not store those values.

If you don't want your information transferred abroad, you can choose not to sign up or delete your account, and you can refuse visit records using the methods in section 6.

5Cookies and browser storage

• Login cookies: a cookie that keeps you logged in (30 days, unreadable by scripts and sent over HTTPS only) and a marker cookie noting that you have logged in.
• Display cookie: a cookie that remembers whether you collapsed the sidebar (7 days).
• Browser storage: your visitor identifier, tool settings, and game progress and records are kept in this browser's storage (localStorage), and short-lived values such as the weather and visit count are kept in storage that clears when you close the tab (sessionStorage). They disappear when you clear your browser data.

We don't use advertising cookies or other companies' tracking cookies.

6Opting out and your rights

• If you turn on your browser's Do Not Track setting, no visit records are sent.
• If your browser sends a Global Privacy Control (GPC) signal, we skip per-page records of time, scrolling and features used, detailed region and referral values, and account linking. A basic visit record (visitor identifier, first page, referring site, country and device type) and game run records without an account are still kept.
• You can turn off news emails at any time on your account page.
• You can also change your nickname or delete your account right there.
• To see, correct or delete your information, send a request to the contact below.

Children under 14

We don't accept sign-ups from anyone under 14. You are asked to confirm your age when signing up.

How we keep it safe

• Login codes and sessions are stored only as hashes.
• Email addresses are masked even in the admin screens.

7Contact and changes

The person responsible for privacy is the operator of BellRiver Lab. Please send questions or requests to the email address below.

If this policy changes, the change is announced on this page with a new effective date. If a change means collecting more, members are asked to agree again.