Privacy Policy

1990Company, at 601, 7, Cheonjung 1-gil, Dongnam-gu, Cheonan-si, Chungcheongnam-do, South Korea, is the controller for Play account, Credits, entitlement, consent, and privacy-request data. Contact privacy@1990.company about this policy or a request.

Participating games run on separate origins. 1990Company remains responsible for the account and orchestration data described here, while each game service controls its game-owned progress, rewards, leaderboard, and gameplay identifiers as described on its game page.

Creem acts as an independent controller and Merchant of Record for checkout and payment data. Its own buyer terms and privacy notice apply when you use Creem checkout.

We process account identifiers, verified email, authentication and security records, session IP address and user agent, consent history, Credits lots and ledger entries, checkout and payment references, entitlements, launch tickets, and links to game-owned identities.

You provide an email address, account choices, support messages, and privacy requests. We generate security, session, wallet, entitlement, and launch records as you use Play. Creem sends payment status, order, product, customer, refund, and dispute references. Connected games send the minimum identity, redemption, and privacy-response data needed for orchestration.

We do not receive or store full payment-card details. Creem collects payment and billing details in its checkout under its own privacy notice.

We process data to create and secure accounts, deliver Credits and entitlements, launch games, answer support and privacy requests, prevent fraud, maintain transaction evidence, and comply with legal obligations. These purposes rely on performance of our contract, legitimate interests in security and service integrity, and legal obligations as applicable.

Marketing email is based on separate consent. It is optional, is not required to create an account, and can be withdrawn at any time. We honor Global Privacy Control as an opt-out signal at boundaries where it applies.

We do not use Play data for solely automated decisions that produce legal or similarly significant effects. Security and fraud signals may restrict an action for review, and you can contact support about a restriction.

Cloudflare hosts Play and the EU-jurisdiction D1 databases. Creem receives checkout data. Our Listmonk infrastructure sends transactional email and separately consented marketing. Google receives authentication data only if Google sign-in is offered and selected. Participating game services receive only the identity and entitlement data needed for that game.

Some providers may process data outside your country. We assess provider terms and use applicable transfer mechanisms or safeguards. See the Service Providers page for current roles and links to provider notices.

Account and wallet data is kept while the account is active. Expired launch tickets and rate-limit records are removed on operational schedules. Expired verification and session records are removed after a short operational buffer. Privacy export snapshots are cleared after 24 hours or when the account is deleted.

When deletion completes, sessions and linked identities are removed and requests are forwarded to connected games and email systems. Some transaction, ledger, entitlement, refund, dispute, and anti-fraud records may be retained where required for tax, accounting, chargeback, legal-claim, or service-integrity purposes. Identifying fields are minimized or pseudonymized where the record must remain.

Retention for those required records follows the applicable statutory, payment-dispute, and legal-claim periods. We review the need for continued retention and delete or anonymize records when the applicable purpose ends.

Depending on your location, you may request information, access, correction, deletion, restriction, portability, or object to processing. You may withdraw consent without affecting earlier lawful processing and complain to your local data protection authority.

Use Privacy & data in your account for export, marketing withdrawal, email correction, and deletion, or email us. We may verify account control before acting. GDPR requests are generally answered within one month, subject to permitted extensions. We do not sell or share personal information for cross-context behavioral advertising.

Play uses a host-only session cookie needed for account authentication. Browser storage keeps display preferences and a recent-games list on that device. Play does not currently use third-party behavioral advertising cookies. See the Cookie and Storage Notice for details and controls.

We separate game and account origins, use short-lived launch tickets, verify payment webhooks, and restrict operational access. No internet service can guarantee absolute security.

Play is not directed to children who cannot lawfully consent to the service in their country. A parent or guardian can contact us about a child’s data. We will date material policy updates and provide additional notice where required.