Privacy Policy

1. Overview

EchoPlayroom 운영팀 (the "team") runs EchoPlayroom (echoplayroom.com), a playground of free browser games and experiments. Most games can be played without signing in, and there is no membership sign-up.

This policy covers the website and the WARURU Android app (com.echoplayroom.waruru). The app loads the web game in a WebView, so the analytics, advertising, and server requests within that view are covered below. Sign-in, uploads, and posting in other games apply when you use those features.

The WARURU Android app is intended primarily for teenagers aged 16 and above and adults. It does not ask for an age or date of birth or automatically verify age. Other web games describe their own intended audiences.

2. Information we collect

These are the values we actually receive and keep.

• Contact form: your name, email address, enquiry type, and message. For game production and advertising or partnership enquiries, we also collect your preferred timeline and budget range if you choose to provide them.
• Google sign-in (optional): your Google account identifier, email address, name, and profile picture URL are included in a signed sign-in cookie. Using integrated game services while signed in can also store your account identifier, name, games used, and first and latest activity times in our operations database. Signing out clears the sign-in cookie; it does not automatically delete server records.
• Game records: a nickname (typed by you or assigned automatically), scores and rankings, and play progress.
• Text you post: the author name and body of anything you write in a game or the showroom (comments, cheer messages, victory messages, and the like).
• Deletion passwords: so that work created without signing in (Stick Studio and similar) can be removed later, the password you choose is stored only as an irreversible hash. The password itself is never stored.
• Device identifier: a random string your browser creates on the first visit. It lets you keep your own records without signing in, and it is not linked to a name or email address.
• Recovery codes and public profile numbers: issued by some games so your progress can follow you to another device.
• Uploaded files: images and sounds that a signed-in player uploads to their personal library, along with the file name, type, and size.
• Game activity and operations records: game opens, play starts and ends, event times, and the game involved. For signed-out visitors, the server uses part of a keyed hash of the IP address and date as a daily pseudonymous actor. Signed-in activity uses the account identifier. Pseudonymisation does not remove the activity record itself.
• Visit and game analytics: Google Analytics 4 cookie identifiers, page URLs (including query information) and referral sources, session and engagement times, interactions such as game, weapon and mission choices and mission success, and browser, device, operating system, screen and language information. Google may derive an approximate region from the IP address. This is separate from directly reading an Android advertising ID.
• Connection and abuse-prevention information: IP addresses, request paths, and browser or device information reach our server and hosting provider with requests. Some features use IP addresses or pseudonyms in in-memory request limits. The hosting provider may also process connection information to operate and secure the service.
• WARURU real-address building lookup (optional): the building address you enter is sent to our server, which sends the address and lookup coordinates to VWorld's geocoding and building-information APIs. The feature does not read GPS or your device's current location. No address is sent if you do not use it.

3. Device storage and sharing links

WARURU mission best records, drawings and demolition designs, last mode, and control-guide acknowledgement are kept in browser or app WebView local storage. Session storage also restores a shared building in the current tab. Separate analytics and operations events, such as play activity and mission success, are sent. Optional building-sharing links contain a design code in the URL's b query parameter. This value is removed from the address bar when the link opens, but the design code may also reach Google Analytics if the initial page URL is collected first.

Language, accessibility and other settings are also stored on the device. Other games may send information needed for their server saves, leaderboards or posting features. The Android app also remembers the chosen language in app settings and, where supported, Android's per-app language settings.

You can remove local records by clearing browser site data or the app's data in Android settings. Uninstalling, reinstalling or changing devices can lose them. WARURU does not provide server backup or cross-device synchronisation of the current round. Clearing device data does not also delete server or analytics-service records.

Deletion passwords are also remembered there so you do not have to type them again. On a shared computer, please clear the site data when you are done.

Some games ask for microphone or camera permission. The audio and video are processed on your device only and are never uploaded. You can refuse the permission at any time.

4. How we use it

• Saving game records and showing leaderboards
• Answering your enquiries and telling you the outcome
• Improving the service using visit statistics
• Reviewing game opens, play starts and ends, and responding to operational issues
• Preventing abuse such as falsified records or excessive requests
• Looking up the building at an address you request and making its game model
• If advertising is integrated in the future, serving and measuring ads, including personalisation according to the advertising service's settings

5. How long we keep it

• Contact enquiries (name, email, enquiry type, message, and any optional timeline and budget range): kept for one year after the enquiry is handled, then deleted.
• Server game records, nicknames, comments, cheer messages, and signed-in operations member records: kept while needed to provide the service. Deletion requests are reviewed and handled as described below.
• Operations activity logs: the server keeps the most recent 10,000 entries within a 30-day window, pruning when the store is read or updated. There is no separate scheduled deletion at the exact expiry time, so expiry and actual pruning may occur at different times.
• Sign-in cookie: expires after 30 days. The temporary sign-in cookie lasts 10 minutes.
• Language cookie: one year.
• Request limits usually use a rolling one-minute window. Expired entries may be removed on later requests, memory cleanup or server-process termination; the window does not mean every value is deleted immediately after one minute. Pseudonyms in operations activity logs follow the log retention rule above.
• Real-address lookup: this API processes addresses and lookup results without caching or separately retaining them in the database or application logs. The game model stays in the current page's memory until a reload, building change or similar action. Hosting-provider and VWorld request processing is also subject to those providers' policies.
• Google Analytics retention settings: event data is retained for 2 months and user data for 14 months, with the user retention period reset on new activity. These settings are separate from retention of aggregate reports. Cookie expiry and Google's service policies also apply; deletion within one minute or complete anonymity is not promised.
• Uploaded files: kept until you delete them or ask us to.

6. Cookies and advertising

EchoPlayroom uses cookies to remember your language choice and your signed-in state.

The website and the web game inside the WARURU app use Google Analytics 4. Identifiers in cookies such as _ga distinguish visitors and sessions, and the visit and game events described above are sent to Google for statistics reports. The use of a random identifier does not mean that no data is transmitted or collected.

The service and WARURU app may provide advertising in the future. As of October 24, 2026, the first WARURU Android internal test has no advertising SDK or web ad delivery integrated. Analytics also has no Google Ads, AdSense or AdMob product links. When ads are added, we will update this policy and the app's relevant declarations to reflect the actual processing.

Google Signals and user-provided data collection are currently disabled. The Analytics setting that allows advertising personalisation is enabled, but this alone does not mean personalised ads are currently served or data is being used for ad targeting. If web ads are integrated in the future, cookies or similar identifiers, IP, browser and device information, and ad impressions and clicks may be processed according to the provider, consent and advertising settings.

You can adjust personalised advertising in Google Ads Settings and clear stored data through browser or Android app-data settings. Restricting storage may affect settings and saved progress. Opting out of personalised ads or clearing data does not stop every analytics or security request. Any separate consent or advertising-choice screen also applies where it is provided.

7. External services, data sharing and international transfers

We use the providers below to run the service. Processing by Vercel, Google, Resend, OpenAI and xAI may send or store information on servers abroad, including in the United States. The data for a provider's feature is sent when that feature is used.

The Google Analytics account's ‘Google products and services’ data sharing setting is enabled. Analytics data may therefore be shared with Google to improve its products and services, subject to Google's Controller-Controller Data Protection Terms. This sharing is distinct from processing solely for the team's statistics reports.

• Vercel Inc. (USA) — website hosting and server operation, for as long as the service runs.
• Google LLC (USA) — Google Analytics statistics and product and service improvement sharing under the setting above, plus Google account sign-in when you choose it. Advertising such as Google AdSense applies only to the extent it is integrated in the future.
• VWorld (Republic of Korea) — geocoding an address you enter for real-address building lookup and querying building information at and around the resulting coordinates. We do not include your name, account or device location as inputs to this lookup.
• Resend (USA) — delivering contact form messages to the team's mailbox.
• OpenAI, xAI (USA) — when a signed-in player uses the image generation feature of the personal asset library, the description they type is sent to these providers. Nothing is sent if you do not use that feature.

8. Your rights

You may ask to access, correct, delete or stop processing your information through the contact page or email below. We check applicable law, your authority to make the request and whether the records can be identified, then handle the request and explain the outcome. If a legal retention duty or another reason prevents full fulfilment, we explain why.

For records left without signing in (nickname, score, comment), tell us the nickname or the record number shown in the game so we can find it.

We cannot remotely delete WARURU records stored only on your device; clear the app or site data yourself. A name alone may not identify a daily pseudonymous activity or analytics record. We will explain what information is needed to review the request. Do not send passwords or authentication tokens.

Requests: nseed@nseed.co.kr

9. Children under 14

We do not knowingly collect personal information from children under 14. If we learn that such information was collected without a guardian's consent, we delete it immediately. Guardians can ask us to check and delete it at the email address above.

10. Security

Traffic between your device and the website or game APIs, and address-lookup requests from our server to VWorld, is encrypted with HTTPS. The sign-in cookie is HttpOnly so scripts cannot read it, and it is signed to prevent forgery. Stored information is accessible only to the few people who need it to run the service.

11. Privacy contact

Person in charge: Privacy Officer (EchoPlayroom 운영팀)

Email: nseed@nseed.co.kr

Send privacy questions, complaints, and remedy requests to this address.

12. Changes to this policy

If this policy changes, the change and its effective date will be posted on this page. Changes that disadvantage users will be announced at least seven days in advance.

First effective: September 18, 2026. Last updated: October 24, 2026. This update clarifies coverage of WARURU Android and the existing analytics, advertising, activity-log and address-lookup processing.