Privacy policy

Article 1 (Purposes of Processing Personal Information)

1. Linking Steam accounts, identifying users, saving and restoring game progress, and providing online services
2. Providing AI conversation and voice features, character settings, conversation context, memories, affinity, emotions, story branches, and destiny content
3. Storing, publicly sharing, and managing UGC selected by users, and handling reports
4. Granting, deducting, and managing balances of in-game currency, and confirming purchases and refunds
5. Handling customer inquiries, rights requests, and disputes; preventing misuse; and responding to security incidents and service failures
6. Analyzing usage statistics and errors and improving game quality
7. Developing, training, and evaluating the Company’s AI models and improving conversation quality and safety, based on the optional consent described in Article 7
8. Complying with legal obligations, including retention of transaction records Processing needed to generate game responses and maintain conversation memories is distinguished from model training for multiple users. If a purpose changes, the Company will take the measures required by applicable law, including obtaining separate consent.

Article 2 (Items Processed, Collection Methods, and Legal Bases)

Processing necessary to perform a contract is based on Article 15(1)(iv) of the Personal Information Protection Act (PIPA); consent-based processing on Article 15(1)(i); and legal obligations on Article 15(1)(ii). Processing based on legitimate interests, such as preventing misuse, is limited to the scope of Article 15(1)(vi). Article 15 of this Policy also applies to users outside Korea.

Article 3 (Retention Periods)

The Company destroys personal information without delay when a reason for destruction arises, such as achievement of the purpose, withdrawal of consent, or a lawful deletion request. Where a statutory retention obligation applies, only the applicable records are segregated and retained.

Article 4 (Provision to Third Parties)

The Company provides personal information to third parties only to the extent necessary and only where separate consent or a legal basis permits it. Transfers to processors for entrusted work are described in Article 5, and overseas transfers in Article 6. Valve is an independent platform operator that processes Steam account, purchase, and payment information under its own policies. When Steam integration features are used, the information the Company sends to Valve is Steam Cloud save files (game progress and settings), achievement records, authentication verification information, and in-game purchase confirmation information; the purposes are save synchronization, achievements, authentication, and transaction confirmation, and the retention period follows Valve’s policies (basis: performance of a contract; Articles 17(1)(ii) and 15(1)(iv) of PIPA). The Company does not sell private conversations for advertising or disclose them to other users. This Policy is not permission for external vendors to use user conversations to train general-purpose models.

Article 5 (Entrustment of Processing)

The Company contracts directly with and uses the services below, and reflects and manages the statutory requirements in its contracts, including prohibitions on processing outside the purpose, safeguards, restrictions on sub-entrustment, deletion, and management and oversight.

Article 6 (Overseas Transfers)

Among the services in Article 5, the following are processed and stored outside Korea. The Company gives notice as follows in accordance with Article 28-8 of the Personal Information Protection Act (PIPA).

Article 7 (AI Conversations and Model Training)

7.1 Processing to provide the service

The Company uses inputs and responses, together with the necessary character settings, conversation context, summaries, and memories, to generate responses and maintain game progress. If the voice feature is selected, the Company converts speech to text and synthesizes responses as speech. This processing is distinct from the model-training consent described below, and processing necessary for the selected game features continues even if training is refused.

7.2 Optional consent for Conversation Data and purposes of use

At the game’s first launch, the Company may obtain separate, optional consent, distinct from basic game use, to use Conversation Data for developing, training, fine-tuning, and evaluating the Company’s AI models and for improving conversation quality, context comprehension, character consistency, and safety. The Company stores the consent decision, its time, the wording version, and withdrawal records. The data concerned is Conversation Data exchanged between a user and AI characters and stored as text, and it applies to conversations generated after consent. Text converted from voice input and stored is also included in Conversation Data. Original audio, photographs, and videos are not stored or used for training. Payment, download, or game use itself is not considered consent to training, and refusing does not disadvantage basic game progress or use of purchased content.

7.3 Database storage and anonymization before training

Conversation Data is stored in the Company’s database to generate game responses and maintain progress and memories, and the original records are subject to personal-information protections and the retention and destruction standards in Article 3. Conversations of users who have not consented to training are not incorporated into training. The Company selects Conversation Data within the scope of training consent and anonymizes it so that individuals cannot be identified before it is used in actual model training. In addition to account identifiers, the Company removes and reviews identifying information contained in the conversation text and the possibility of linking the data to the original or the account, and excludes sensitive information and identifiers of other individuals at the selection stage. Material for which adequate anonymization cannot be ensured is not used for training.

7.4 Refusing or withdrawing training consent, and deletion

Training consent may be withdrawn at any time by contacting hello@tridot.io. Once withdrawal is confirmed, the Company stops selecting new conversations for training, immediately excludes from training any Conversation Data and training copies that can be linked to the user, and deletes them without delay unless a separate lawful basis for retention applies. Exclusion from training does not replace deletion. Conversation Data that has already been anonymized so that the user can no longer be identified may be difficult to locate and delete for a particular user; the maximum retention period in Article 3 still applies to such material. It may be difficult to remove the effect of a particular sentence individually from a trained model, but this does not mean that legal rights concerning personal information are excluded; the Company takes the measures required by applicable law and informs the user of the outcome.

7.5 Training by external AI providers

The external AI providers the Company uses through APIs (OpenAI, Google, Anthropic, and ElevenLabs) do not use data sent by the Company to train their own models, in accordance with each provider’s API data-use policy. Consent to the Company’s own training is not consent to training by external providers.

7.6 Review by authorized personnel

Authorized personnel may review content to the extent necessary to handle inquiries, reports, service failures, and security issues, and to lawfully select, anonymize, and evaluate Conversation Data. Access is limited to the minimum personnel and scope required for the work.

7.7 AI outputs and automated decisions

Characters are AI, not real people, and responses may contain errors. Responses and destiny content are not medical, legal, or financial advice. Affinity, emotion, and story branching based on conversation analysis are processing for game progress, and the Company does not make automated decisions that materially affect users’ rights or obligations.

7.8 Deleting conversations

Users may request deletion of conversations with an individual character or of all conversations at hello@tridot.io. Related summaries, memories, and relationship state are also processed according to the requested scope, and deletion may make it impossible to restore the related game progress. Deletion of the Company’s data and Steam Cloud copies are distinguished under Article 10.

Article 8 (Public Sharing of UGC and Online Chat)

Settings, content, and display names publicly shared through the UGC sharing feature can be viewed by other users, and the visibility scope is explained before posting. In online chat and room features, display names and messages are shown to users in the same room. Do not post personal information or another person’s photograph or contact information. Private conversations are not made public merely by sharing UGC. The Company uses the identifiers of the reporting and reported accounts and the related content only to the extent necessary to handle reports. Infringement reports may be submitted to hello@tridot.io. Upon a deletion request, the Company deletes or blocks the public copies it controls, but copies already downloaded by other users may be difficult to retrieve.

Article 9 (Steam Payments and Refunds)

Valve processes payment methods directly, and the Company processes the information under Article 2 needed to confirm transactions and manage currency. Refunds for the base game are governed by the Steam Refund Policy and applicable law, and the prices, use, and refund conditions for in-game currency are set out in the notice presented before purchase. The Company only views the refund reports that Steam provides to developers when needed to respond to inquiries, and does not export or separately store them. Payment and refund records follow the statutory periods in Article 3.

Article 10 (Destruction and Platform Copies)

Personal information that is no longer needed is destroyed without delay. Electronic information is deleted using methods that prevent recovery or reproduction, and paper records are shredded or incinerated. Deletion is reflected, according to its scope, in the operational database, derived data for summaries, memories, and search, training copies, and personal information transferred to processors. Backup copies are deleted within the regular rotation cycle, and information subject to deletion is not reused when a backup is restored. When the Company confirms that a Steam account has been deleted, it also destroys the related information it holds, except information subject to statutory retention. Disabling Steam Cloud synchronization alone does not delete existing Cloud copies; for information independently held by Valve, users must also use the procedures in the Steam Privacy Policy.

Article 11 (Exercising Rights)

Users and their lawful representatives may contact hello@tridot.io to exercise rights of access, correction, deletion, suspension of processing, and withdrawal of consent, as well as other rights under applicable law. The Company may request the minimum verification necessary to confirm account ownership, and does not request a full identity document or resident registration number. The Company acts within the statutory period and explains any reason for limitation or refusal.

Article 12 (Children and Adolescents)

The game and its AI features are available to users aged 15 or older, and the Company does not collect personal information from users under 15. If information of a user under 15 is identified, it is deleted without delay. All protections in this Policy apply equally to adolescent users, and for users outside Korea, the age and legal-guardian consent standards of the relevant region apply.

Article 13 (Safeguards)

The Company implements technical and organizational measures under applicable law, including an internal management plan, training for personnel handling personal information, minimum access privileges, access-log management, encryption, and security software, and manages safeguards including physical controls at cloud facilities. The selection, anonymization, segregated storage, and access restrictions in Article 7 apply to Conversation Data used for training. In the event of a breach, the Company complies with statutory notification and reporting requirements.

Article 14 (Analytics and Choices)

For optional usage analytics through GameAnalytics and PlayFab, the Company explains the purposes, items, recipients, and retention period before transmission and obtains separate consent. Refusal or withdrawal may be requested at hello@tridot.io, and refusing or withdrawing does not disadvantage basic game use. New transmission stops after withdrawal. Analytics events contain only state and category values such as screen navigation, button actions and results, stage completion and drop-off, error codes, session, build and content versions, OS type, language settings, and input method, together with an analytics identifier generated by the SDK. Nickname, date of birth, nationality, gender, original conversation or voice content, Steam ID, email, and IP address are not included in analytics events. The Company does not collect advertising identifiers and does not track users for advertising purposes. The game does not use web cookies. Cookies on the official website are described separately in the website’s privacy policy.

Article 15 (Regional Rights)

15.1 EEA and United Kingdom

Where the relevant law applies, service provision is based on performance of a contract; optional training and analytics on consent; security and misuse response on legitimate interests; and statutory retention on legal obligations. Users may exercise rights of access, rectification, erasure, restriction of processing, portability, objection, and withdrawal of consent, and may lodge a complaint with the competent supervisory authority; the Company generally responds within one month. Transfers from the EEA and the United Kingdom to Korea rely on the EU and UK adequacy decisions for the Republic of Korea, and information transferred from Korea to the third countries in Article 6 is protected by contractual safeguards.

15.2 California

To the extent the CCPA/CPRA applies, the Company guarantees rights including the right to know what is collected, access, deletion, and correction, and does not discriminate against users for exercising their rights. The Company does not sell personal information or share it for cross-context behavioral advertising.

15.3 Chinese-language users

The Chinese versions are language-specific notices, and the Company guarantees the rights under mandatory laws that apply based on the regions where the service is provided and the actual processing. Rights may be exercised through the contact in Article 11.

15.4 Taiwan

The purposes of collection are set out in Article 1, and the categories of data, periods, regions, recipients, and methods are as set out in Articles 2, 3, 5, and 6. Under the applicable Personal Data Protection Act, users may request inquiry, access, and copies; supplementation and correction; and cessation of processing or use and deletion. Refusing optional training or analytics does not affect basic game use.

Article 16 (Chief Privacy Officer and Contact Information)

• Chief Privacy Officer: Kyungchan Jun (전경찬) / Chief Executive Officer
• Rights-request intake and handling: Operations Team
• Email: hello@tridot.io
• Company: Tridot Inc. (주식회사 트라이닷) / Representative: Kyungchan Jun (전경찬)
• Address: Suite 604, 217 Yeoksam-ro, Gangnam-gu, Seoul, Republic of Korea - Business registration number: 372-81-01941 / Mail-order business registration number: 2024-Seoul Gangnam-06300

Article 17 (Remedies for Infringement of Rights)

Users may contact the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118 within Korea), or the Korean National Police Agency Cybercrime Reporting System (ecrm.police.go.kr). Users outside Korea may also lodge a complaint with the competent supervisory authority in their place of residence.

Article 18 (Changes and Languages)

This Policy takes effect on September 14, 2026. If its content changes, the Company will give notice in the game or on this page 7 days before the change takes effect (30 days for changes that materially affect user rights), and will separately carry out any additional notice or consent required by applicable law. Continued use or acknowledgement of a notice alone is not considered consent to training. The Korean, English, Simplified Chinese, and Traditional Chinese versions describe the same processing standards. Translation differences do not reduce users’ statutory rights, and confirmed discrepancies will be corrected. Previous versions are made available together with their effective periods.