Privacy Policy

Effective: August 5, 2026·v1.2

The operator of Squadon (the "Operator") establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act to protect users' personal information and promptly handle related complaints.

Company: Squadon

Representative: Lee Hyunjin

Business Registration No.: No. 2026-Gyeonggi Siheung-1821

Email: fcsquadon@gmail.com

Article 1 (Personal Information Collected)

The Operator collects the following personal information to provide the Service.

1. Upon Social Login (Required)

  • Social provider unique ID (Kakao / Google / Apple)
  • Email address (collected only when disclosed by the social provider — not collected if Apple "Hide My Email" is selected)

2. During Onboarding and Profile Setup

ItemRequired
NameRequired
Birth YearRequired
GenderOptional
Primary PositionRequired
Dominant FootRequired
Years of ExperienceRequired
Skill LevelRequired
Contact (Phone Number)Optional
Profile ImageOptional
Preferred RegionOptional

3. Automatically Collected During Service Use

  • Device information (FCM token — for push notification delivery)
  • Device advertising identifier (IDFA/GAID — for ad personalization; collected only with user consent on iOS)
  • In-app purchase information (subscription status, original transaction ID, product ID, subscription expiry — collected only for paid service users)
  • Service usage records (match attendance, voting, post creation, etc.)
  • App access logs (server request logs — for security and incident response)

Article 2 (Purpose and Use of Personal Information)

PurposeItems UsedRetention Period
Member registration and identity verificationEmail, social ID, nicknameUntil withdrawal
Service provision (match/club management, etc.)Name, position, contact info, profileUntil withdrawal
AI player card generationProfile image, stat data — transmitted to fal.aiImmediately deleted after generation
Push notification deliveryFCM tokenUntil withdrawal or token expiry
Matching/mercenary contact provisionName, phone number30 days after post closes
Ad services (Google AdMob)Device advertising identifier (IDFA/GAID)Until end of entrustment contract
Paid services (in-app purchases)Subscription status, original transaction ID, product ID, expiry date5 years after cancellation (E-Commerce Act)
Fraud prevention and securityAccess logs, device information3 months
Legal complianceItems specified by applicable lawAs required by law

Article 3 (Third-Party Disclosure)

The Operator does not, in principle, disclose users' personal information to third parties. Exceptions include:

  1. When the user has provided prior consent
  2. When required by law or pursuant to a lawful request from investigative authorities

Article 4 (Entrustment of Personal Information Processing)

The Operator entrusts personal information processing as follows for service provision.

TrusteeEntrusted WorkRetention/Use Period
Railway, Inc.Server infrastructure and database operationsUntil end of contract
Cloudflare, Inc.Image/media file storage and CDN deliveryUntil end of contract
Google FirebasePush notification (FCM) deliveryUntil end of contract
fal.aiPlayer card image generationImmediately deleted after generation
Google LLC (AdMob)Ad service provisionUntil end of contract
Apple Inc.App Store in-app purchase processingUntil end of contract
Google LLC (Play Billing)Google Play in-app purchase processingUntil end of contract

Trustees may not use personal information for purposes other than the entrusted work or provide it to third parties.

All trustees are based in the United States. Details on overseas transfers are in Article 4-2.

Article 4-2 (Overseas Transfer of Personal Information)

The Operator transfers personal information overseas as follows for service operations. If you do not consent to such transfers, you cannot use the Service.

RecipientCountryContactPurposeItemsRetention
Railway, Inc.USAlegal@railway.appServer infrastructure & DBAll member and match/club dataUntil end of contract
Cloudflare, Inc.USAprivacyquestions@cloudflare.comMedia storage & CDNProfile images, uploaded filesUntil end of contract
Google LLC (Firebase)USAsupport.google.com/policiesPush notifications (FCM)FCM token, notification contentUntil end of contract
fal.ai, Inc.USAsupport@fal.aiPlayer card image generationProfile image, stat dataDeleted after generation
Google LLC (AdMob)USAsupport.google.com/policiesAd serviceDevice advertising ID (IDFA/GAID)Until end of contract
Apple Inc.USAwww.apple.com/legal/privacyApp Store IAP processingSubscription status, transaction ID, product IDUntil end of contract
Google LLC (Play Billing)USAsupport.google.com/policiesGoogle Play IAP processingSubscription status, purchase token, product IDUntil end of contract

Article 5 (Retention and Use Period)

  1. The Operator retains personal information until the collection purpose is fulfilled and destroys it upon withdrawal request. Uploaded video/highlight files will be destroyed within 30 days after withdrawal for service continuity.
  2. The following information is retained for the periods required by law:
    ItemLegal BasisRetention Period
    Records of contracts or withdrawal of subscriptionE-Commerce Act5 years
    Records of consumer complaints or dispute resolutionE-Commerce Act3 years
    Access logs, access IP informationAct on Promotion of Information and Communications Network Utilization3 months

Article 6 (Destruction of Personal Information)

  1. When a user withdraws or the retention period expires, the personal information is destroyed without delay.
  2. Destruction methods:
    • Electronic files: Permanently deleted in a manner that cannot be restored or reproduced
    • PII: Name, email, phone, profile image, birth year, and gender are set to null

Article 7 (User Rights and How to Exercise Them)

Users may exercise the following rights at any time:

  1. Right to access: View the status of personal information processing
  2. Right to rectification/deletion: Correct or delete inaccurate information
  3. Right to restrict processing: Temporarily suspend processing of personal information
  4. Right to withdraw consent: Withdraw optional consents (e.g., marketing) at any time

Requests may be made through in-app profile settings or by emailing fcsquadon@gmail.com and will be processed within 10 business days.

Article 7-2 (How to Delete Your Account and Data)

Users may request account deletion at any time; requests are processed immediately.

1. In-App Deletion

  1. Go to the Profile tab at the bottom of the app
  2. Tap Settings (⚙️) in the top right
  3. Select Account Management → Withdraw
  4. Select a reason and tap Withdraw

2. Email Request

If you cannot access the app, email fcsquadon@gmail.com to request account deletion (processed within 10 business days).

3. Data Processed Upon Deletion

ItemMethodTiming
Name, phone, profile image, birth year, genderImmediately set to null (unrecoverable)Upon withdrawal
Social provider ID (Kakao/Google/Apple)Immediately deletedUpon withdrawal
FCM push tokenImmediately deletedUpon withdrawal
Non-identifiable data (match records, etc.)Anonymized and retained for service continuityAnonymized upon withdrawal
Uploaded video/highlight filesRetained then deletedWithin 30 days of withdrawal
Access logs, IP informationRetained per Act on Information and Communications NetworkDestroyed after 3 months

Article 8 (Cookies and Automatic Collection)

The Operator's app does not use cookies. However, anonymized app usage analytics may be collected for service quality improvement.

Article 8-2 (Use of Ad Services)

This app uses Google AdMob. AdMob may collect device advertising identifiers (IDFA/GAID) and app usage data for personalized ad delivery.

  • iOS: An App Tracking Transparency (ATT) consent prompt is shown on first launch. Declining does not restrict app use; non-personalized ads will be shown.
  • Android: Ad personalization is determined by the device's advertising ID settings.

For details on how Google processes data, see the Google Privacy Policy.

Article 8-3 (Personal Information for Paid Services and In-App Purchases)

This app provides paid subscription services via in-app purchases through the App Store and Google Play. Actual payment details (card numbers, etc.) are processed directly by each store; the Operator does not collect them.

  • Payment-related information collected: subscription status, original transaction ID, product ID, subscription expiry date
  • Purpose: verification of paid service access and subscription management
  • Retention: 5 years after cancellation (Act on the Consumer Protection in Electronic Commerce)

Article 9 (Measures to Ensure Safety of Personal Information)

The Operator takes the following measures to ensure safe processing of personal information:

  1. Encryption: Passwords and refresh tokens are stored using one-way encryption (bcrypt/SHA256)
  2. Access control: Access rights management for personal information processing systems
  3. Communication encryption: Personal information transmitted via HTTPS (TLS)
  4. Security updates: Regular security patches for servers and libraries
  5. Access log management: Access records retained for 3 months

Article 9-2 (Personal Information of Children Under 14)

  1. The Operator does not collect or use personal information from children under 14 and does not permit service registration by children under 14.
  2. If a child under 14 attempts to register, the service agreement is not formed and any entered information is immediately destroyed.
  3. If it is discovered that information from a child under 14 has been collected, it will be immediately deleted.

Article 10 (Privacy Officer)

The following person is designated as Privacy Officer to oversee personal information processing and handle complaints.

Name: Lee Hyunjin

Email: fcsquadon@gmail.com

Office Hours: Weekdays 10:00 – 18:00 KST

For privacy violation reports or consultations, contact:

  • Personal Information Infringement Report Center: privacy.kisa.or.kr / 118
  • Supreme Prosecutors' Office Cyber Crime Division: spo.go.kr / 1301
  • National Police Agency Cyber Bureau: ecrm.cyber.go.kr / 182

Article 11 (Changes to This Privacy Policy)

This Privacy Policy may be updated in response to changes in law, policy, or the Service. Changes will be announced in the in-app notice section at least 7 days before the effective date.

This Privacy Policy is effective as of August 5, 2026.