Privacy Policy
The operator of Squadon (the "Operator") establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act to protect users' personal information and promptly handle related complaints.
Company: Squadon
Representative: Lee Hyunjin
Business Registration No.: No. 2026-Gyeonggi Siheung-1821
Email: fcsquadon@gmail.com
Article 1 (Personal Information Collected)
The Operator collects the following personal information to provide the Service.
1. Upon Social Login (Required)
- Social provider unique ID (Kakao / Google / Apple)
- Email address (collected only when disclosed by the social provider — not collected if Apple "Hide My Email" is selected)
2. During Onboarding and Profile Setup
| Item | Required |
|---|---|
| Name | Required |
| Birth Year | Required |
| Gender | Optional |
| Primary Position | Required |
| Dominant Foot | Required |
| Years of Experience | Required |
| Skill Level | Required |
| Contact (Phone Number) | Optional |
| Profile Image | Optional |
| Preferred Region | Optional |
3. Automatically Collected During Service Use
- Device information (FCM token — for push notification delivery)
- Device advertising identifier (IDFA/GAID — for ad personalization; collected only with user consent on iOS)
- In-app purchase information (subscription status, original transaction ID, product ID, subscription expiry — collected only for paid service users)
- Service usage records (match attendance, voting, post creation, etc.)
- App access logs (server request logs — for security and incident response)
Article 2 (Purpose and Use of Personal Information)
| Purpose | Items Used | Retention Period |
|---|---|---|
| Member registration and identity verification | Email, social ID, nickname | Until withdrawal |
| Service provision (match/club management, etc.) | Name, position, contact info, profile | Until withdrawal |
| AI player card generation | Profile image, stat data — transmitted to fal.ai | Immediately deleted after generation |
| Push notification delivery | FCM token | Until withdrawal or token expiry |
| Matching/mercenary contact provision | Name, phone number | 30 days after post closes |
| Ad services (Google AdMob) | Device advertising identifier (IDFA/GAID) | Until end of entrustment contract |
| Paid services (in-app purchases) | Subscription status, original transaction ID, product ID, expiry date | 5 years after cancellation (E-Commerce Act) |
| Fraud prevention and security | Access logs, device information | 3 months |
| Legal compliance | Items specified by applicable law | As required by law |
Article 3 (Third-Party Disclosure)
The Operator does not, in principle, disclose users' personal information to third parties. Exceptions include:
- When the user has provided prior consent
- When required by law or pursuant to a lawful request from investigative authorities
Article 4 (Entrustment of Personal Information Processing)
The Operator entrusts personal information processing as follows for service provision.
| Trustee | Entrusted Work | Retention/Use Period |
|---|---|---|
| Railway, Inc. | Server infrastructure and database operations | Until end of contract |
| Cloudflare, Inc. | Image/media file storage and CDN delivery | Until end of contract |
| Google Firebase | Push notification (FCM) delivery | Until end of contract |
| fal.ai | Player card image generation | Immediately deleted after generation |
| Google LLC (AdMob) | Ad service provision | Until end of contract |
| Apple Inc. | App Store in-app purchase processing | Until end of contract |
| Google LLC (Play Billing) | Google Play in-app purchase processing | Until end of contract |
Trustees may not use personal information for purposes other than the entrusted work or provide it to third parties.
All trustees are based in the United States. Details on overseas transfers are in Article 4-2.
Article 4-2 (Overseas Transfer of Personal Information)
The Operator transfers personal information overseas as follows for service operations. If you do not consent to such transfers, you cannot use the Service.
| Recipient | Country | Contact | Purpose | Items | Retention |
|---|---|---|---|---|---|
| Railway, Inc. | USA | legal@railway.app | Server infrastructure & DB | All member and match/club data | Until end of contract |
| Cloudflare, Inc. | USA | privacyquestions@cloudflare.com | Media storage & CDN | Profile images, uploaded files | Until end of contract |
| Google LLC (Firebase) | USA | support.google.com/policies | Push notifications (FCM) | FCM token, notification content | Until end of contract |
| fal.ai, Inc. | USA | support@fal.ai | Player card image generation | Profile image, stat data | Deleted after generation |
| Google LLC (AdMob) | USA | support.google.com/policies | Ad service | Device advertising ID (IDFA/GAID) | Until end of contract |
| Apple Inc. | USA | www.apple.com/legal/privacy | App Store IAP processing | Subscription status, transaction ID, product ID | Until end of contract |
| Google LLC (Play Billing) | USA | support.google.com/policies | Google Play IAP processing | Subscription status, purchase token, product ID | Until end of contract |
Article 5 (Retention and Use Period)
- The Operator retains personal information until the collection purpose is fulfilled and destroys it upon withdrawal request. Uploaded video/highlight files will be destroyed within 30 days after withdrawal for service continuity.
- The following information is retained for the periods required by law:
Item Legal Basis Retention Period Records of contracts or withdrawal of subscription E-Commerce Act 5 years Records of consumer complaints or dispute resolution E-Commerce Act 3 years Access logs, access IP information Act on Promotion of Information and Communications Network Utilization 3 months
Article 6 (Destruction of Personal Information)
- When a user withdraws or the retention period expires, the personal information is destroyed without delay.
- Destruction methods:
- Electronic files: Permanently deleted in a manner that cannot be restored or reproduced
- PII: Name, email, phone, profile image, birth year, and gender are set to null
Article 7 (User Rights and How to Exercise Them)
Users may exercise the following rights at any time:
- Right to access: View the status of personal information processing
- Right to rectification/deletion: Correct or delete inaccurate information
- Right to restrict processing: Temporarily suspend processing of personal information
- Right to withdraw consent: Withdraw optional consents (e.g., marketing) at any time
Requests may be made through in-app profile settings or by emailing fcsquadon@gmail.com and will be processed within 10 business days.
Article 7-2 (How to Delete Your Account and Data)
Users may request account deletion at any time; requests are processed immediately.
1. In-App Deletion
- Go to the Profile tab at the bottom of the app
- Tap Settings (⚙️) in the top right
- Select Account Management → Withdraw
- Select a reason and tap Withdraw
2. Email Request
If you cannot access the app, email fcsquadon@gmail.com to request account deletion (processed within 10 business days).
3. Data Processed Upon Deletion
| Item | Method | Timing |
|---|---|---|
| Name, phone, profile image, birth year, gender | Immediately set to null (unrecoverable) | Upon withdrawal |
| Social provider ID (Kakao/Google/Apple) | Immediately deleted | Upon withdrawal |
| FCM push token | Immediately deleted | Upon withdrawal |
| Non-identifiable data (match records, etc.) | Anonymized and retained for service continuity | Anonymized upon withdrawal |
| Uploaded video/highlight files | Retained then deleted | Within 30 days of withdrawal |
| Access logs, IP information | Retained per Act on Information and Communications Network | Destroyed after 3 months |
Article 8 (Cookies and Automatic Collection)
The Operator's app does not use cookies. However, anonymized app usage analytics may be collected for service quality improvement.
Article 8-2 (Use of Ad Services)
This app uses Google AdMob. AdMob may collect device advertising identifiers (IDFA/GAID) and app usage data for personalized ad delivery.
- iOS: An App Tracking Transparency (ATT) consent prompt is shown on first launch. Declining does not restrict app use; non-personalized ads will be shown.
- Android: Ad personalization is determined by the device's advertising ID settings.
For details on how Google processes data, see the Google Privacy Policy.
Article 8-3 (Personal Information for Paid Services and In-App Purchases)
This app provides paid subscription services via in-app purchases through the App Store and Google Play. Actual payment details (card numbers, etc.) are processed directly by each store; the Operator does not collect them.
- Payment-related information collected: subscription status, original transaction ID, product ID, subscription expiry date
- Purpose: verification of paid service access and subscription management
- Retention: 5 years after cancellation (Act on the Consumer Protection in Electronic Commerce)
Article 9 (Measures to Ensure Safety of Personal Information)
The Operator takes the following measures to ensure safe processing of personal information:
- Encryption: Passwords and refresh tokens are stored using one-way encryption (bcrypt/SHA256)
- Access control: Access rights management for personal information processing systems
- Communication encryption: Personal information transmitted via HTTPS (TLS)
- Security updates: Regular security patches for servers and libraries
- Access log management: Access records retained for 3 months
Article 9-2 (Personal Information of Children Under 14)
- The Operator does not collect or use personal information from children under 14 and does not permit service registration by children under 14.
- If a child under 14 attempts to register, the service agreement is not formed and any entered information is immediately destroyed.
- If it is discovered that information from a child under 14 has been collected, it will be immediately deleted.
Article 10 (Privacy Officer)
The following person is designated as Privacy Officer to oversee personal information processing and handle complaints.
For privacy violation reports or consultations, contact:
- Personal Information Infringement Report Center: privacy.kisa.or.kr / 118
- Supreme Prosecutors' Office Cyber Crime Division: spo.go.kr / 1301
- National Police Agency Cyber Bureau: ecrm.cyber.go.kr / 182
Article 11 (Changes to This Privacy Policy)
This Privacy Policy may be updated in response to changes in law, policy, or the Service. Changes will be announced in the in-app notice section at least 7 days before the effective date.
This Privacy Policy is effective as of August 5, 2026.