Privacy Policy

Spinefairy (the "Company") establishes and publishes this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act of the Republic of Korea, in order to protect the personal information of data subjects and to handle related complaints promptly.

Article 1 (Scope)

This Privacy Policy applies to the PC programs and mobile apps of Game Dev Assistant ("GDA") and Narratip and to all related services provided by the Company (the "Service"). Where the services differ, this Policy says so. GDA accounts and Narratip accounts are separate, and personal information is processed separately for each service.

Article 2 (Basic Principles)

The Company processes personal information in compliance with the following principles:

• Making the purposes of processing clear and collecting only the minimum personal information needed
• Processing lawfully within those purposes and not using information beyond them
• Keeping personal information accurate and up to date
• Taking technical, administrative, and physical measures to keep it secure
• Protecting the rights of data subjects and being transparent about processing
• Maintaining a personal information protection management system based on accountability

Article 3 (Items Processed, Purposes, and Retention Periods)

The Company processes personal information only to the minimum extent needed to provide the Service. The items below are processed under Article 15(1)4 of the Personal Information Protection Act (performance of a contract).

The following information may be generated and collected automatically while you use the Service:

• Access time, IP address, and request records: kept as server access records for stable operation and to prevent misuse. The IP address used when you start linking a PC is one-way hashed, used only for rate limiting, and deleted within 1 hour.
• Program version and operating system type: sent when the PC program or the mobile app checks for and downloads updates.

While a PC is being linked (up to 5 minutes), the name of the approving device and a partially masked sign-in email address are held temporarily on the server so they can be shown on the PC screen. They are deleted when linking finishes or the time runs out.

The Company does not currently process any personal information on the basis of consent.

Article 4 (Information the Company Does Not Collect)

The Service is built so that your work is processed on your own devices. The Company does not collect the following:

1. Works: The text, images, audio, code, and project files you create with or enter into the Service are stored on your PC and are not sent to the Company's servers.
2. Content exchanged with Third-Party AI Services: The instructions you send to Third-Party AI Services (such as AI agents and image or audio generation services), and their output, go directly from your PC to the provider of that service and do not pass through the Company's servers (Article 8).
3. Credentials for Third-Party AI Services: API keys and other credentials you enter in the PC program are stored on your PC, encrypted with the operating system's secure storage, and are not sent to the Company.
4. Content exchanged through remote features: Chats, approvals, status, and other content exchanged through the mobile app's remote features are encrypted with a key held only by your PC and your mobile device. The Company's servers only relay the encrypted content; they cannot read it and do not store it. In GDA, files attached remotely are held on the server temporarily in encrypted form and deleted once your PC receives them, or within 24 hours if it does not. Narratip does not use remote attachments.
5. Content of push notifications: Push notifications do not contain the content of your Works or conversations.
6. Advertising identifiers: The Service carries no advertising and does not collect advertising identifiers (such as IDFA or AAID).

Article 5 (Retention After Account Deletion)

1. When you delete your account, the Company deletes your account information and the information about your linked PCs and mobile devices without delay.
2. However, to prevent misuse such as repeated Free Trials and to complete deletion safely, the Company keeps the following information for 1 year from the date the account is deleted and then destroys it (Article 15(1)6 of the Personal Information Protection Act, legitimate interests of the Company):
   • A one-way hash of your sign-in identifier, processed so that it can no longer identify you: used only to withhold a second Free Trial if you sign up again with the same sign-in method, and to reconnect any remaining subscription or Plan to the new account. Your email address and sign-in method cannot be recovered from this value.
   • The internal identifier of the deleted account: used only to prevent the account from being re-created by a request made while deletion is in progress.
3. Payment records (the "Payments" category in Article 3) are kept for 5 years as required by law. When you delete your account, they are disconnected from the account and linked only through the one-way hash described in Paragraph 2. That link is also removed after 1 year.
4. Information that must be kept under applicable laws, and the retention periods, are as follows:
   • Records on contracts or withdrawal of offers, and records on payment and supply of goods: 5 years (Act on Consumer Protection in Electronic Commerce)
   • Records on consumer complaints or dispute resolution: 3 years (same Act)
   • Service access records: 3 months (Protection of Communications Secrets Act)

Article 6 (Provision to Third Parties)

The Company does not provide users' personal information to third parties, except where the data subject has consented, where a law specifically provides for it, or in other cases falling under Articles 17 and 18 of the Personal Information Protection Act.

Article 7 (Outsourcing of Processing and Overseas Transfer)

To provide the Service, the Company outsources part of its personal information processing as shown below, and takes the measures required by applicable laws, such as entering into outsourcing agreements and supervising the processors. Some processors are overseas companies, so personal information may be processed outside the Republic of Korea.

Apple and Google are Platform Operators that provide the sign-in and payment methods. During sign-in and payment, they process your information directly under their own privacy policies. The Company does not receive your payment method details, such as card numbers.

If you do not want your information transferred overseas, you may stop using the Service and delete your account. Because the outsourcing above is essential to providing the Service, the Service cannot be used if you refuse the transfer.

Article 8 (Third-Party AI Services)

1. The main features of the Service work together with Third-Party AI Services that you sign up for, or enter credentials for, yourself.
2. Content you send to a Third-Party AI Service (such as Works and instructions) goes directly from your PC to that provider and is handled under that provider's terms and privacy policy. The Company does not collect the content sent in this process, and providers of Third-Party AI Services are not processors of the Company.
3. Please review the provider's privacy policy before sending personal or sensitive content to a Third-Party AI Service.

Article 9 (Destruction of Personal Information)

The Company destroys personal information without delay when it is no longer needed, such as when the retention period ends or the purpose of processing has been achieved.

1. Procedure: The Company selects the personal information to be destroyed and destroys it with the approval of the Company's personal information protection officer.
2. Method: Personal information stored as electronic files is destroyed so that it cannot be restored. Personal information on paper is shredded or incinerated.

Article 10 (Rights of Data Subjects and Legal Representatives)

1. Data subjects may at any time exercise rights against the Company such as requesting access to, correction of, deletion of, or suspension of processing of their personal information.
2. In the mobile app, you can rename or unlink your linked PCs and mobile devices, and you can delete your account yourself in the app's settings. If you cannot use the mobile app, you can request account deletion by the method described on the Company website or by email (cs@spinefairy.com). The Company will process the request without delay after verifying your identity.
3. Requests under Paragraph 1 may be made to the Company in writing, by email, or by similar means under Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will act on them without delay.
4. Rights under Paragraph 1 may be exercised through a legal representative or an authorized agent. In that case, a power of attorney in the form of Appendix No. 11 of the Public Notice on Personal Information Processing Methods must be submitted.
5. Deleting your account does not automatically cancel a subscription made through a Platform Operator. Please cancel it in your Platform Operator account settings.

Article 11 (Security Measures)

The Company takes the following measures to keep personal information secure:

1. Administrative measures
   • Keeping the number of staff who handle personal information to a minimum and training them
   • Establishing and carrying out an internal management plan for personal information processing
   • Conducting regular self-inspections
2. Technical measures
   • Controlling access to personal information and limiting access rights
   • Encrypting data in transit, and end-to-end encrypting remote content between PCs and mobile devices
   • Storing entitlement tokens, License Codes, and similar values on the server only as one-way hashes, never in their original form
   • Installing security programs against hacking and malware and checking and updating them regularly
   • Keeping access records and protecting them from tampering
3. Physical measures
   • Using locks to securely store documents and storage media containing personal information

Article 12 (Personal Information Protection Officer)

The Company has appointed the following personal information protection officer to oversee personal information processing and to handle complaints and remedies for data subjects:

• Name: Jae-hyeok Jang
• Title: CEO
• Contact: support@spinefairy.com

You may contact the officer about any inquiry, complaint, or request for remedy relating to personal information that arises while you use the Service. The Company will respond and act without delay.

If you need to report or seek advice about an infringement of personal information, please contact the following organizations in the Republic of Korea:

• Privacy Infringement Report Center: 118 (privacy.kisa.or.kr)
• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Supreme Prosecutors' Office, Cyber Investigation Division: 1301 (www.spo.go.kr)
• Korean National Police Agency, Cyber Investigation Bureau: 182 (ecrm.police.go.kr)

Article 13 (Children's Personal Information)

Children under the age of 14 may use the Service only with the consent of a legal representative. If the Company learns that it has collected the personal information of a child under 14 without such consent, it will delete that information without delay.

Article 14 (Changes to This Privacy Policy)

1. This Privacy Policy takes effect on October 1, 2026.
2. If the Company changes this Privacy Policy, it will keep the timing and content of the change publicly available and will publish a comparison of the previous and updated versions so that data subjects can easily review the changes.
3. Previous versions of this Privacy Policy: none (first enactment).