Privacy Policy

MNT (hereinafter the "Company") establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act ("PIPA") of the Republic of Korea and applicable international data protection laws, in order to protect the personal information of data subjects and to promptly and effectively handle related grievances. This Policy applies to the mobile application Nova - Brain Puzzle (hereinafter the "Service") provided by the Company, and applies to all users of the Service worldwide.

1. Purposes of Processing Personal Information

The Company processes personal information for the purposes set out below and does not use such personal information for any purpose other than those stated. Where the purpose of use changes, the Company will take necessary measures, such as obtaining separate consent, in accordance with Article 18 of PIPA.

Account linking and identification: Where a user optionally links an Apple or Google account, to identify the account and to sync and restore game progress data.

Service operation and improvement: To analyze Service usage, respond to errors and malfunctions, and improve features.

Advertising: To serve non-personalized advertisements to users of the free version.

In-app purchase processing: To confirm purchases of paid items (ad removal) and to support refunds and withdrawal of subscription (cooling-off).

Prevention of fraudulent use: To prevent abuse, fraudulent payments, fraudulent ad clicks, and similar activities.

2. Categories of Personal Information Processed and Methods of Collection

The Company does not require account registration as a condition of use, and processes the following items.

A. Information provided directly by the user

Category	Items	Time of collection
Account linking (optional)	Email address of the linked account	When the user links an Apple/Google account
Customer inquiries	The email address and inquiry content provided by the user	When the user submits an inquiry

If a user uses Apple's "Hide My Email" feature when linking an Apple account, the Company receives an anonymized relay email address generated by Apple.

B. Information collected automatically during use of the Service

The Service uses an analytics tool (Google Analytics 4 / Firebase) and an advertising tool (Google AdMob). The following information may be automatically collected and processed in this course.

Collecting party	Items
Google Analytics 4 / Firebase	App-instance ID; device advertising identifiers (on iOS, the IDFA is collected only if the user consents via App Tracking Transparency (ATT); on Android, the Advertising ID (AAID)); alternative identifiers (IDFV or Android ID); device information (OS version, device model, device language, country/region); app usage events and logs; approximate location (IP-based, city level)
Google AdMob (non-personalized ads)	IP address (for ad delivery, city-level geo-targeting, and fraud prevention); cookies or mobile advertising identifiers used for frequency capping, aggregated ad reporting, and abuse prevention

The Company operates non-personalized advertising only and does not perform profiling for personalized (interest-based) advertising based on a user's past behavior. However, even for non-personalized ads, the above identifiers and IP address are used for frequency capping, aggregated reporting, and fraud prevention.

Google Analytics 4 does not store IP addresses for analytics purposes; it uses them to estimate approximate location and then discards them.

C. Information related to in-app purchases

In-app purchases are processed solely through the payment systems of the Apple App Store and Google Play. The Company does not directly collect or store users' payment instrument information, such as card numbers or account numbers, and may process only transaction identification information (e.g., order IDs, purchase receipts) to the extent necessary for refunds and purchase verification.

3. Processing and Retention Periods of Personal Information

The Company processes and retains personal information within the retention and use periods prescribed by law or consented to by the data subject.

Item	Retention period
Linked account email	Until the account link is terminated or the user withdraws from the Service
Analytics data (GA4/Firebase)	Up to 14 months from the date of collection (in accordance with the Google Analytics data retention policy)
Customer inquiry records	6 months after completion of the inquiry (or the retention period required by applicable law)
E-commerce transaction records	Retained in accordance with the Act on Consumer Protection in Electronic Commerce, etc. and other applicable laws

Actual payment records are retained by Apple/Google, and the Company retains transaction identification information only to the extent necessary to process refunds.

4. Provision of Personal Information to Third Parties

The Company does not provide users' personal information to third parties beyond the scope of the purposes set out in Section 1 of this Policy, except in the following cases:

•

Where the user has given prior consent; or

•

Where required by law, or where an investigative authority so requests in accordance with the procedures prescribed by law.

5. Outsourcing of Personal Information Processing

To operate the Service, the Company outsources (or carries out data processing equivalent to outsourcing) the following personal information processing tasks.

Processor	Outsourced task
Google LLC	Service usage analytics (Google Analytics 4 / Firebase), ad delivery (AdMob), in-app payment processing (Google Play billing)
Apple Inc.	Account linking (Sign in with Apple), in-app payment processing (App Store billing)

When entering into outsourcing agreements, the Company stipulates the matters necessary to ensure that personal information is managed safely in accordance with applicable laws. Where the content of the outsourced task or the processor changes, the Company will disclose such change through this Policy.

6. Cross-Border Transfer of Personal Information

Because the Service relies on the infrastructure of global providers, personal information may be transferred overseas as follows.

Recipient	Country	Items transferred	Purpose	Time and method of transfer	Retention/use period
Google LLC	United States	Automatically collected information under Section 2.B	Usage analytics and ad delivery	Transferred from time to time over the network during use of the Service	As set out in Section 3
Google LLC	United States	Transaction identification information	In-app payment (Google Play) processing	Transferred from time to time at the time of payment	As set out in Section 3
Apple Inc.	United States	Linked account email, transaction information	Account linking and payment processing	Transferred from time to time at the time of account linking/payment	As set out in Section 3

A user may refuse the cross-border transfer of their personal information by contacting the Company; however, in that case, analytics-based service improvements and certain features may be limited. For safeguards applicable to users in the European Economic Area (EEA) and the United Kingdom, please refer to Section 11.

7. Procedures and Methods for Destruction of Personal Information

Where the retention period has elapsed or the purpose of processing has been achieved and the personal information is no longer necessary, the Company destroys such personal information without delay.

•

Destruction procedure: After the purpose is achieved, information is either destroyed immediately or destroyed after being retained for a certain period in accordance with internal policies and applicable laws.

•

Destruction method: Information in electronic file format is deleted using technical methods that render it irrecoverable and unreproducible.

8. Installation, Operation, and Refusal of Automatic Collection Devices (Cookies, Identifiers, etc.)

The Service uses mobile advertising identifiers and technologies similar to cookies for analytics and ad delivery. Users may refuse or reset these by the following methods:

•

iOS: Settings → Privacy & Security → Tracking → turn off "Allow Apps to Request to Track," or select "Ask App Not to Track."

•

Android: Settings → Privacy → Ads → delete or reset Advertising ID.

Even if a user refuses the use of advertising identifiers, non-personalized ads may continue to be displayed, and ads will not be removed (ad removal is available only through purchase of the paid item).

9. Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them

Users may exercise the following rights at any time:

The right to request access to their personal information;

The right to request correction of errors;

The right to request deletion; and

The right to request suspension of processing.

These rights may be exercised by contacting the Personal Information Protection Officer set out in Section 13, and the Company will act without delay. In addition, users may exercise certain rights directly by terminating the link to their account or by refusing the collection of analytics and advertising identifiers in their device settings. For additional rights based on your region of residence, please refer to Section 11.

10. Processing of Personal Information of Children Under 16

The Service is not directed to users under the age of 16, and use by individuals under the age of 16 is restricted. The Company does not knowingly collect personal information from children under the age of 16. If it is confirmed that personal information of a child under the age of 16 has been collected, the Company will delete such information without delay. If a guardian believes that their child's personal information has been collected, they may contact the address in Section 13, and the Company will take immediate action.

11. Rights of International Users (GDPR / CCPA, etc.)

The Service is provided globally, and users may have additional rights under the laws of their region of residence, as follows.

A. Users in the European Economic Area (EEA) and the United Kingdom (GDPR / UK GDPR)

•

Legal bases for processing: The Company processes personal information on the bases of (i) performance of a contract to provide the Service, (ii) legitimate interests such as analytics, security, and fraud prevention, and (iii) consent where legally required.

•

Rights: Users have the rights of access, rectification, erasure, restriction of processing, data portability, objection to processing, and withdrawal of consent.

•

Consent for advertising/identifiers: Although the Company operates non-personalized advertising only, it separately obtains consent for the use of cookies and identifiers where legally required in the EEA and the UK.

•

Safeguards for cross-border transfers: Where personal information is transferred to the United States or other countries, such transfers are carried out under appropriate safeguards provided by the processors (Google, Apple), such as Standard Contractual Clauses (SCCs) or the EU-US / UK Data Privacy Framework.

•

Complaints to a supervisory authority: Users have the right to lodge a complaint with the data protection authority in their country.

B. California Residents (CCPA / CPRA)

•

Users have the right to know about the personal information collected, used, and shared; the right to request deletion; the right to request correction; and the right to opt out of the sale or sharing of personal information.

•

The Company does not sell personal information for monetary consideration.

C. Exercising Your Rights

The above rights may be exercised by contacting the address in Section 13, and the Company will act within the period prescribed by applicable law.

12. Measures to Ensure the Security of Personal Information

In accordance with Article 29 of PIPA and applicable laws, the Company implements the following measures to ensure the security of personal information:

•

Minimizing the number of personnel handling personal information and managing access privileges;

•

Encryption of personal information in transit (TLS); and

•

Access controls for the personal information processing systems.

13. Personal Information Protection Officer

The Company designates the following Personal Information Protection Officer to take overall responsibility for tasks related to the processing of personal information and to handle data subjects' inquiries, complaints, and remedies arising from the processing of personal information.

•

Personal Information Protection Officer: PARK DO YEONG

•

Contact (email): moveandtouch.io@gmail.com

14. Remedies for Infringement of Rights

Users may contact the following organizations for remedies, consultation, etc. regarding infringement of personal information.

Residents of the Republic of Korea:

•

Personal Information Dispute Mediation Committee: 1833-6972 / www.kopico.go.kr

•

Privacy Infringement Report Center (KISA): 118 / privacy.kisa.or.kr

•

Supreme Prosecutors' Office, Cybercrime Investigation Division: 1301 / www.spo.go.kr

•

National Police Agency, Cyber Bureau: 182 / ecrm.police.go.kr

Residents of the EEA / UK: You may lodge a complaint with the data protection authority in your country. (UK: Information Commissioner's Office, ico.org.uk / List of EEA national authorities: edpb.europa.eu)

Residents of other regions: You may contact us directly at the address in Section 13, or contact the competent data protection authority in your region of residence.

15. Changes to This Privacy Policy

This Privacy Policy may be supplemented, deleted, or amended in accordance with changes in laws, policies, or the Service. Any changes will be announced through a notice within the Service or by posting this Policy.

Date of announcement: June 26, 2026
Effective date: June 26, 2026

Made with Slashpage