Privacy Policy
B-Territory (the "Service") treats personal data with care and complies with the Personal Information Protection Act and the Act on the Protection and Use of Location Information of the Republic of Korea.
Article 1 (Personal Data Collected) 1. Collected at sign-up - Email address, nickname, nationality (used for team assignment) - Firebase authentication identifier (UID). For accounts created with an email address, the Service does not store the password; it is held by Google Firebase Authentication. - A record of terms agreed to (which documents and revision dates, whether age 14+ was confirmed, and when) - Where the user signs up or signs in with a Google account, the email address is received from Google rather than entered by the user, and no password is created by the Service. The nickname and nationality are entered by the user regardless of the sign-up route. 2. Collected or generated while using the Service - GPS location from the device (collected only while the app is in use; not recorded as a history in the database - see Article 4 for how coordinates are held and deleted) - Site claim records (site identifier, team, user identifier - coordinates are not included) - Mission visit confirmations (site identifier and the district code of that site - coordinates are not included; see Article 4(5) for the retention period) - Duel records (opponent, outcome, point changes) - Mission photos and reviews (content the user takes or writes - a photo file may retain location data recorded by the capturing device; the Service does not check for or remove it, keeping the file as-is. See Article 4(6)) - Reports and blocks - Records of the fact that location information was used (see Article 4) 3. The Service does not track location in the background and does not collect push notification tokens. 4. Chat messages between users on the same team are relayed in real time and are not stored on the server. If a message is reported, however, its content at the time of the report is kept separately in the report record for handling the report (see Article 3(2)).
Article 2 (Purposes of Use) 1. Identifying members and managing accounts 2. Verifying visits, deciding claims, and tallying team and district points 3. Confirming a visit so that site missions (photos and reviews) can be submitted 4. Detecting nearby users and matching duels 5. Calculating and displaying rankings (Hall of Fame) 6. Handling reports, operating the Service, and preventing abuse 7. Proving that consent was obtained and responding to disputes about consent
Article 3 (Retention and Destruction) 1. When a user deletes their account, data that directly identifies them - email, nickname, nationality, authentication identifier - is deleted from the operational database without delay. If the user has been reported, however, the nickname recorded at the time of that report is retained under paragraph 4, and the record of terms agreed to is retained separately under paragraph 3. 2. The point ledger, claim records, duel records, mission photos and reviews, and reports are combined with other users' records and team tallies, and therefore remain with the user identifier removed - except for the reported-nickname and message-content fields in a report record (see paragraph 4). 3. On account deletion, the record of terms agreed to is moved out of the tables used to operate the Service into separate archive tables used only for this purpose, kept for six months, and then destroyed. - What is kept: the type and revision date of each document agreed to, whether age 14+ was confirmed, the time of agreement, and the email address needed to attribute that record to the user. - Why it is kept: to discharge the operator's burden, under the Personal Information Protection Act and the Act on the Protection and Use of Location Information, of proving that consent was obtained, and to respond to disputes about whether it was. Destroying the evidence at the moment of withdrawal would make that proof impossible, so only the minimum is retained. - These archive tables are not used to operate the Service. They are not used to identify a withdrawn user within the Service, to restrict re-registration, or for advertising or statistics. - Once the retention period ends the archive is destroyed automatically, after which the Service can no longer confirm that consent was given. 4. The following four remain after account deletion. - Records of location information use: retained for six months under Article 16(2) of the Act on the Protection and Use of Location Information, then deleted. - Photo files uploaded through missions: the files themselves are currently not deleted on account deletion; only the identifier linking a photo to the user is removed. - The nickname and message content recorded at the time of a report: kept separately from the account, for the timely handling of reports, and are not removed from the report record when the account is deleted. - The archived record of terms agreed to: kept for six months under paragraph 3 and then destroyed. 5. Information subject to a statutory retention obligation is kept for the required period and then destroyed.
Article 4 (Processing of Location Information) 1. The Service uses location information to verify visits to tourist sites, to confirm a visit so that site missions can be submitted, and to match users in real time. 2. Coordinates are held in server memory as a single most-recent entry per user, in order to detect nearby users and to decide whether a duel may take place. They are not accumulated into a movement trail or a visit history; a new coordinate overwrites the previous one. 3. Stored coordinates are deleted as follows. - Immediately when the user disconnects from the app. - Within at most 15 minutes of the last update, for coordinates left behind by an abnormal disconnection. - Immediately upon account deletion. 4. Coordinates are not stored in the database. Claim records contain only the site identifier, not coordinates. 5. A site mission may be submitted within 24 hours of confirming a visit near the site. To make that possible, the site identifier and that site's district code are kept for 24 hours from the moment the visit is confirmed and are deleted automatically once that period ends. This record contains no coordinates. Unlike the coordinates in paragraphs 2 and 3, it survives disconnection from the app; it is deleted immediately upon account deletion. 6. Under Article 16(2) of the Act on the Protection and Use of Location Information, a record of the fact that location information was used - user identifier, acquisition path, service category, and time of use - is created automatically and retained for six months. This record does not contain coordinates. 7. Paragraphs 2 to 5 of this Article concern the location information used to detect nearby users, to decide duels in real time, and to confirm mission visits. Location data that a capturing device itself records in a mission photo file is not extracted or used by the Service, and is not removed either - it is kept as-is together with the photo, and its retention and deletion follow Article 1(2) and Article 3. 8. Details concerning location information are set out in the separate Location-Based Services Terms.
Article 5 (Provision to Third Parties) The Service does not provide personal data to third parties, except where lawfully required by investigative or other authorities under applicable law.
Article 6 (Entrusted Processing) The Service entrusts the processing of personal data as follows.
1. Google (Firebase Authentication) Entrusted work: member authentication, Google account sign-in, password storage, email verification 2. Amazon Web Services Entrusted work: server operation, storage of mission photo files, and storage of the archived consent records under Article 3(3)
The map view is rendered with the Google Maps SDK embedded in the app. The Service does not transmit the user's coordinates to Google, and the current-location marker is drawn by the app itself rather than by the SDK. The SDK does, however, communicate with Google in order to render the map.
Article 7 (User Rights) 1. Users may review their personal data at any time and delete their account from within the app. 2. Users may withdraw location permission in their device settings. Without location permission, visit verification, site missions, and duel features cannot be used. 3. Requests may be sent to B.territory123@gmail.com. 4. Users may also request access to, or destruction of, their archived consent record held under Article 3(3). Where destruction is requested, the Service will explain that it will no longer be able to prove that consent was obtained from that user.
Article 8 (Children Under 14) The Service does not accept sign-ups from children under the age of 14 and deletes the personal data of any account confirmed to belong to a child under 14.
Article 9 (Security Measures) 1. All communication is protected by encrypted connections (HTTPS/WSS). 2. For accounts created with an email address, passwords are not held by the Service; they are delegated to Firebase Authentication. For accounts created with a Google account, the Service neither creates nor holds a password. 3. Access to personal data is limited to the minimum necessary for operations. 4. The archived consent records under Article 3(3) are held in dedicated tables, separate from the tables used to operate the Service, and no Service feature reads them. Access is limited to cases where proof of consent is required.
Article 10 (Contact) Enquiries, complaints, and remedy requests concerning the processing of personal data are received at B.territory123@gmail.com and will be answered promptly.
Addendum This Policy takes effect on 8 September 2026. Any change will be announced in the app with the effective date and the reason for the change.