1. Operator and scope
Hidden Stage (the “operator”) protects the personal information of players of Cloud Garden: Lumi’s Invitation (the “service”) under applicable laws, including the Korean Personal Information Protection Act. This policy covers the app, game servers, support and this website.
- Operator
- Hidden Stage (히든스테이지)
- Representative · privacy contact
- Kim Gyu-taek (김규택)
- Business registration number
- 659-04-03807
- Business address
- Suite 110, 1F, 17 Galmaesunhwan-ro, Guri-si, Gyeonggi-do, Republic of Korea
- Contact and privacy requests
- hiddenstagedev@gmail.com
This policy describes how information is processed. It does not replace separate consent or a legal guardian’s consent where required.
2. Information and purposes
| Feature | Information | Purpose |
|---|---|---|
| Guest account and play | Server-generated account ID, nickname, authentication and session data, settings such as language and sound, levels, scores, puzzle progress, garden layout, currency, items, missions, events and reward records | Identify the account, save and restore progress, provide the game, and prevent duplicate rewards |
| Optional Google or Apple linking | Provider account identifiers, authentication tokens, one-time authorization codes and link status. An encrypted token is used for Apple unlinking. | Link and restore the account, authenticate and revoke the link. Google and Apple passwords are not collected by us. |
| Friends, guilds and rankings | Nickname, account ID, cleared levels and rankings, guild details, chat, friends, help, gifts, reports and blocks | Provide social features and rankings, and protect players |
| Optional rewarded ads | In-game account ID, reward request and transaction identifiers, viewing and reward records. The ad SDK may process advertising identifiers, IP, device information, diagnostics and ad interactions. | Show ads, prevent invalid views or duplicate grants, and deliver rewards. SDK data depends on device, consent and advertising settings. |
| Store purchases, when available | Product ID, purchase token or signed transaction, transaction ID, payment, cancellation, refund and delivery status | Verify, deliver and recover purchases and handle disputes. We do not collect card numbers or store passwords directly. |
| Support and deletion requests | Messages, reply email when contacting us by email, account details, app version and device details provided by the player, and optional attached diagnostics | Answer inquiries, investigate errors, verify the requester and handle privacy requests |
| Access and security | IP and other connection information, request time, route and response status, app version and platform, error and security logs | Connect to and protect the service, investigate incidents and prevent abuse |
Information is provided when you use a feature or enter data, generated while using the service, or received from an authentication, billing or advertising provider you choose to use. Necessary processing is distinguished from optional processing. Where consent is required, it is sought separately after the relevant information is provided.
3. Information visible to other players
Rankings, friends and guilds can show information needed for those features, including nicknames, avatars, cleared levels, ranks, guild information and messages you post. If garden visits are available, the garden and placed decorations can be viewed by other players. Authentication tokens, private support messages and payment verification data are not public.
The operator does not sell or disclose personal information to third parties without a lawful basis or separate consent.
4. Retention and disposal
| Record | Retention and deletion |
|---|---|
| Account and game data | Kept during use of the service. Deleted without undue delay or made non-identifiable when the account is closed, consent is withdrawn, or the purpose has been fulfilled. Records that must be retained by law follow the periods below. |
| Contracts, cancellations, payments and supply of goods | Five years for transactions subject to applicable Korean e-commerce recordkeeping requirements. |
| Consumer complaints and disputes | Three years when required under Korean e-commerce law. This does not apply to every general support inquiry. |
| Product listings and advertising records | Six months when required under Korean e-commerce law. This is not a six-month blanket retention period for individual ad-viewing history. |
| Other legally required or dispute-related records | Only necessary records are kept separately for the legally required period or the period needed to resolve an actual dispute. They are destroyed when the reason for retaining them ends. |
Records retained by law are kept separately from ordinary service use and access is restricted. Electronic records are deleted using methods intended to prevent recovery, and paper records, if any, are shredded or incinerated. If identity checks or legal retention affect a deletion request, we explain the reason and scope.
Backup data is used only for recovery and security. Completed and pending deletion requests are to be reflected when backups are restored.
5. External providers and overseas processing
| Provider | Role and data | Location, timing and retention |
|---|---|---|
| Cloudflare, Inc. | Game API, database, file storage, delivery and security. Account, game, support and connection data. | Global infrastructure operated by a US company. Data is transmitted over an encrypted connection as the service is used, and is processed and stored as needed. Section 4 describes retention by record type. |
| Google LLC / Google AdMob | Optional Google authentication, rewarded ads and reward verification. Identifiers, authentication, advertising and diagnostic data needed for the selected feature. | The United States and other Google processing regions. Transferred when using the feature or requesting or verifying an ad, subject to provider policy and applicable consent settings. |
| Apple Inc. | Optional Apple authentication, App Store transaction verification and account unlinking. Authentication and transaction identifiers. | The United States and other Apple processing regions. Transferred on use of the feature, verification or unlinking, under provider policy. |
The operator checks and oversees the protection and safe handling of personal information by its service providers. See Cloudflare’s privacy policy, Cloudflare’s subprocessors, Google’s privacy policy and Apple’s privacy policy for provider information.
Overseas transfers must meet any separate consent or notice requirements that apply. You may decline or stop optional sign-in and ad features. Declining necessary server processing and storage can prevent online features such as saving progress. Contact hiddenstagedev@gmail.com for overseas-processing questions and privacy requests.
6. Ads, device storage and choices
Rewarded ads are optional. Use Ad privacy options in the app and the privacy and advertising settings on your device to manage advertising choices. iOS tracking permission is a separate operating-system choice; it is not the same as ad consent.
Secure and app storage are used to keep you signed in and save preferences. Uninstalling the app or clearing browser storage can remove local information, but does not delete the server account. This website does not install an advertising or analytics tool.
7. Children and legal guardians
When consent is required to process the information of a child under 14, consent must be obtained from the child’s legal guardian and verified. Children should receive an explanation in language they can understand. Unnecessary information is not requested to verify consent.
Legal guardians can request access, correction, deletion, suspension of processing or withdrawal of consent for the child at hiddenstagedev@gmail.com. We verify the requester’s relationship and authority using only necessary information; a third party’s unverified request is not enough to delete an account. If we identify processing without required consent, we take the steps required by applicable law.
Collection and advertising that require guardian consent must be supported by an actual consent verification process. Publishing this policy or viewing the terms does not constitute guardian consent.
8. Access, correction, deletion and restrictions
You or your authorized representative may request access, correction, deletion, suspension of processing or withdrawal of consent through hiddenstagedev@gmail.com or in-app support. You can also use Delete account in Settings or the online account deletion page.
Requests are handled without undue delay after verification. We explain any legal restrictions or retention obligations. Making a request does not result in a penalty, although deleting information necessary for a feature may prevent its use.
9. Protection and contact
We use encrypted transport, authentication and access controls, protection of important authentication information, role-based administrative access, access logging and abuse prevention. Do not include passwords, government identity numbers, full payment card numbers or authentication codes in inquiries.
Privacy contact: Kim Gyu-taek, representative, at hiddenstagedev@gmail.com. In Korea, you can also contact the Personal Information Infringement Report Center or Personal Information Dispute Mediation Committee.
10. Policy changes
Effective date: 2026-11-11 · Version 1.0
We publish changes and their effective date here and in app notices or other appropriate channels. Changes that require separate consent follow the procedures required by applicable law.