Privacy Policy

Article 1 (Personal Information Items Collected)

The Company may collect the following personal information to provide services.

1. Upon Membership Registration and Account Linkage

• Required: Email address, password
• Optional: Nickname, profile image

2. Additional Information Collected Upon Using Specific Services

For some services such as fortune-telling and Saju, the following information may be additionally collected.

• Gender, date of birth, time of birth, place of birth

3. Information Automatically Collected Upon Using Services

• Device information (model name, OS version, app version)
• Log information (IP, access date and time, usage records)
• Advertising ID (GAID, IDFA, etc.)

4. Upon Payment and Use of Paid Services

• Payment records (payment history within the store)
• Ad viewing history (for providing rewarded advertisements)

5. Upon Using the Inquiry Form

When you submit an inquiry through the account.marostory.com inquiry form, the following information is collected.

• Required: The user identifier (UID) in the app concerned, the email address for our reply, and the inquiry subject and content

Article 2 (Method of Collecting Personal Information)

The Company collects personal information in the following ways:

• Direct entry by the user when running the service and signing up
• Social login linkage such as Google/Apple
• Automatic collection during service use
• Customer center inquiries (including the account.marostory.com inquiry form) and event participation

Article 3 (Purpose of Using Personal Information)

The Company uses collected personal information only to the extent necessary for each Service and for the purposes below. The examples below do not apply to every Service; a Service-specific notice applies where available.

Article 4 (Retention and Usage Period of Personal Information)

The Company destroys personal information without delay once the purposes of its collection and use are achieved. However, the following information is stored separately for the periods below as required by law and then destroyed.

• Records on contracts or withdrawal of offers: 5 years (Act on the Consumer Protection in Electronic Commerce)
• Records on payment and supply of goods: 5 years (Act on the Consumer Protection in Electronic Commerce)
• Records on consumer complaints or dispute handling: 3 years (Act on the Consumer Protection in Electronic Commerce)
• Records on labeling and advertising: 6 months (Act on the Consumer Protection in Electronic Commerce)
• Service access logs: 3 months (Protection of Communications Secrets Act)

Inquiry records submitted through the inquiry form (user identifier, email address, and inquiry content) are kept for 3 years from receipt as records on consumer complaints or dispute handling and then destroyed. If account deletion is completed during that period, the user identifier in those records is replaced with a pseudonymous value that cannot be linked to other information.

Service-specific retention items and periods follow the Service-specific notices in this Policy.

Article 5 (Provision of Personal Information to Third Parties)

The Company does not provide personal information to third parties without the user's consent. However, the following cases are exceptions:

• When requested in accordance with laws and regulations
• When the user has agreed in advance

Article 6 (Consignment of Personal Information Processing)

The Company may consign the processing of personal information to the following external companies to provide services.

Article 7 (Rights of the User)

Users can inquire or modify their personal information at any time, and can withdraw their consent to the collection and use of personal information through membership withdrawal. Upon membership withdrawal, all personal information is immediately deleted, and is stored only when storage is required by laws and regulations.

Article 8 (Technical/Managerial Measures for Personal Information Protection)

• Personal information is encrypted and stored, and managed safely.
• Passwords are stored using one-way encryption and are not decrypted.
• Administrator access rights are limited to the minimum, and internal access history is also recorded and managed.
• The service maintains data security during transmission through HTTPS communication.

Article 9 (Cookies and Advertising Identifiers)

The service may collect advertising identifiers (GAID, IDFA, etc.) to provide user-customized advertisements. Users can refuse this through device settings.

Article 10 (Personal Information of Children Under 14)

The Company does not intentionally collect personal information of children under 14, and takes immediate deletion measures upon confirmation.

Article 11 (SaiNote Service-Specific Notice)

This Article applies to the SaiNote app. SaiNote can be used without an account, and guest use and optional account use have different processing scopes.

1. Guest Use

During guest use, people, occasions, congratulatory/condolence and financial records, notes, and personal insights calculated by the app are kept in storage on the user's device. They are not automatically sent to Company servers. Even after an account is connected, they are transferred to account storage only when the user expressly chooses backup, merge, or replacement of account records.

2. Optional Account and Cloud Features

If the user connects an account by email, Google, or Apple, we process account identifiers, email address, authentication-provider information, display name, and an optional profile photo. People, occasions, transactions, notes, and personal insights that the user backs up or creates in the account, as well as feedback and optional attachments, may be stored and processed through Firebase services. Passwords are handled by Firebase Authentication; the Company does not retain plaintext passwords.

3. Optional Features and Permissions

Contacts, device calendar, Google Calendar, and ICS-file import are used only when the user selects the feature and grants the relevant permission. Chosen information is shown as a draft for creating a record, and only information the user confirms is retained as a record. Profile photos and feedback attachments are processed only when selected by the user. Denying a permission limits that optional feature only, not core features.

4. Notifications and Advertising

When a user connects notifications, we process a device-specific push token, platform, and refresh time to send notifications and manage the token. SaiNote advertising may be provided through Google AdMob in line with consent status and device settings. For ad delivery, measurement, and fraud prevention, Google or its partners may process IP address, device and app information, advertising or app identifiers, and ad-interaction information. The scope of advertising-identifier processing may vary by operating system and ad settings.

5. Retention, Deletion, and International Processing

Guest records stored on a device are deleted when the user deletes individual records or chooses to clear local records as part of backup, merge, or account-record replacement. Information stored in an account is deleted upon the user's deletion or account-deletion request, except where retention is required by law, in which case it is retained separately for the required period. Device and server data are separate storage areas and must be deleted separately. When features use overseas providers such as Firebase or AdMob, personal information may be transferred to or processed on servers or by subprocessors outside the user's country. Details that must be disclosed by law, including the recipient, items, country, and retention period, will be provided through a separate in-Service notice or consent process.

Article 12 (Leftty P0 Service-Specific Notice)

This Article applies to the currently released Leftty P0 app. Leftty P0 is a local-only app that keeps user-entered pass, quantity, credit, period, and subscription-schedule records only in app-specific storage on the current device.

1. On-Device Processing Items and Purpose

Leftty P0 processes on the device a managed item's name, type, note, and creation and modification times; remaining balance, quantity, credits, unit, currency, and optional purchase amount; expiration date, period end time, next billing date, and billing cycle; and change history for creation, use, recharge, adjustment, period change, subscription-payment confirmation, and cancellation. This is used only to display remaining values and schedules and to provide a change history the user can review.

2. Local Notifications

If the user permits notifications, Leftty P0 may schedule local notifications through the device operating system for expiration dates or next billing dates. A notification may show an item name and schedule information, which may be visible to someone viewing the device, including on a lock screen. Denying notification permission does not prevent the user from adding, editing, or deleting records, and permission can be changed in device settings.

3. Company-Server Transfers and External Services

Leftty P0 does not offer sign-up, sign-in, or account linkage, and does not send these records to Company servers or link them to a Company account. The current Leftty P0 has no Firebase, remote analytics tool, advertising SDK, in-app purchase SDK, remote push, or merchant, bank, card, or email integration. Accordingly, the Company does not remotely retain, view, or restore Leftty P0 user records, or transmit them for third-party provision, processing delegation, or international transfer.

4. Deletion and Retention

Users can edit or delete their own items in the app. Deleting an item also deletes its change history and associated local notification schedules from the device. Depletion, expiration, subscription cancellation, or moving an item to or hiding it in the archive is not deletion, so the record remains on the device. Because data exists only on the device, it may not be recoverable after app deletion, clearing app storage, device replacement, or reset. Retention and restoration of operating-system or user-configured device backups are governed by that operating system's policies.

5. Device Settings

Leftty P0 reads device language and regional settings locally only to display the interface language and currency. It does not automatically collect or transmit email address, phone number, password, account identifier, advertising identifier, contacts, photos, location, calendar, camera, microphone, payment method, or actual payment details.

Article 13 (Pikmade Service-Specific Notice)

This Article applies to the Pikmade app. Pikmade processes the following information so users can create and keep AI images made from their photos and purchase and use paid passes.

1. Account and Authentication

When a user signs up or signs in with email, Google, or Apple, we may process the Firebase user identifier (UID), email address, sign-in provider information, display name, language and region, and the time and version of terms and privacy consent. Passwords are handled by Firebase Authentication; the Company does not retain plaintext passwords.

2. Photos and AI Image Generation

A photo selected by the user is converted into a JPEG input image suitable for generation and stored, together with the generated result, job status and events, the selected template and generation settings, file paths, and integrity values. During AI generation, only the converted input image and Company-defined style instructions and output settings are sent to OpenAI; account information such as the Firebase UID and email address is not sent. Input images and generated results are retained until the user withdraws the account.

3. Paid Passes (In-App Purchases)

Passes are purchased through Apple App Store or Google Play in-app payments. Payment methods and card details are handled by each store and are not received by the Company. To verify purchases, grant passes, and process refunds, the Company processes the store transaction identifier, purchased product, amount, currency and country, purchase and refund times, payment environment (test or live), and the store-signed proof of purchase. Purchase verification and payment records are handled by the Company's integrated billing platform (MaroStory), while pass balances and usage are managed in Pikmade. Only an account-linking value transformed so that it cannot directly identify the user's account is sent to the stores. Payment records are retained for five years from the date of purchase as required by law, including after account withdrawal, stored separately from other information, and then destroyed.

4. Advertising, App Protection, and Usage Analytics

Depending on consent and device settings, non-personalized ads may be provided through Google AdMob and UMP. Device and app information, advertising or app identifiers, ad interactions, and reward-session information may be processed for delivery, measurement, and fraud prevention, and the Firebase UID and a reward-session identifier may be sent to Google during server-side verification of rewarded ads. To prevent abuse of payments and AI generation requests, Firebase App Check (Apple App Attest and DeviceCheck, Google Play Integrity) is used to process app and device integrity results. To improve the Service, Google Analytics for Firebase processes limited usage events such as language and region, screen views, template, output count, payment type, failure type, and share channel. UID, email, photo URL, input text, authentication token, receipt, and job or session identifiers are not included in analytics events, and Google Analytics for Firebase data is not used for ad personalization. Pikmade uses the SDK of Meta Platforms, Inc. to measure the effectiveness of its own ads on Facebook and Instagram. App installs and opens, App Store/Google Play in-app purchases (product, amount, currency), style views, completed image creations, visits to the pass store and completed pass purchases are sent to Meta together with device and app information, IP address and an identifier created by the SDK. On iOS, the app asks once for App Tracking Transparency permission after your first image and sends the advertising identifier (IDFA) only if you allow it. On Android, the advertising ID may be sent. Photos, generated images, email, account ID, nickname and purchase receipts are not sent. You can refuse or reset advertising identifiers in iOS Settings > Privacy & Security > Tracking or Android Settings > Google > Ads; every feature works the same either way.

5. Guest Use and Account Linking

Guest identifiers are managed separately from member accounts. Guest jobs are moved to a member account only when the user explicitly chooses account linking or merging. A completed account withdrawal also covers the merged source guest identifier and its remaining data.

6. Account Withdrawal and Retention

Account withdrawal can be requested in the app or on the MaroStory account page. When withdrawal is completed, user-owned Firestore documents and Storage files (including input and result images and job and pass records) are deleted, sign-in provider permissions and sessions are revoked, and the Firebase Authentication account is deleted last. If an external AI request is still running or its outcome or cost is uncertain, Pikmade confirms its state before completing deletion to avoid duplicate charges or residual data. Remaining passes cannot be used after withdrawal; refunds follow the procedure of the store where they were purchased. Payment records are kept separately only for the retention period in Section 3.

For cost-calibration records created by an operator to verify service costs, the associated input and result images are deleted immediately when that operator withdraws the account. Metadata needed for cost calculation, such as model, token usage, processing time, amount, currency, and status, is retained for five years from job completion and then destroyed, after replacing the operator UID and user identifier with a de-identified value such as `deleted-operator`. This is the Company's operating policy for validating service cost and comparing cost trends. Original or generated images, email addresses, and authentication information are not included in this five-year retention.

7. International Transfers of Personal Information

Pikmade transfers personal information outside the user's country as follows to provide the Service. Transfers take place over encrypted network connections when the relevant feature is used.

Users who do not want these transfers may stop using the relevant feature or withdraw the account; in that case AI image generation or the relevant sign-in or payment feature cannot be used.

8. Contact

Questions about Pikmade privacy processing or account withdrawal: help@marostory.com

Article 14 (Pipelody Service-Specific Notice)

This Article applies to the Pipelody app. Pipelody processes the following information to provide puzzle gameplay, in-app purchases, and rewarded ads.

1. Account and Authentication

Without a separate sign-up or sign-in screen, the app connects to Firebase Authentication with the device's game account (Game Center on iOS or Google Play Games on Android), or as an anonymous guest if no game account is used. We process the Firebase user identifier (UID), sign-in provider information, and the game account identifier. We do not collect email addresses or passwords.

2. Game Progress

Game progress such as levels, stars, coins, item stock, and settings is stored only on the user's device and is not sent to the Company's servers. It is deleted from the device when the app is deleted.

3. In-App Purchases

Coins, items, Remove Ads, and the Starter Pack are purchased through Apple App Store or Google Play in-app payments, and only when the app is connected to a game account. Payment methods and card details are handled by each store and are not received by the Company. To verify purchases, deliver items, and process refunds, the Company processes the store transaction identifier, purchased product, amount, currency and country, purchase and refund times, payment environment (test or live), and the store-signed proof of purchase. Purchase verification, payment records, claim and refund records of purchased items, and ownership such as Remove Ads are handled on the Company's integrated platform (MaroStory, Google Cloud Seoul region). Only an account-linking value transformed so that it cannot directly identify the user's account is sent to the stores. Payment records are retained for five years from the date of purchase as required by law, including after account withdrawal, stored separately from other information, and then destroyed.

4. Advertising

Depending on consent and device settings, non-personalized ads are provided through Google AdMob and UMP; the app does not request App Tracking Transparency (ATT) permission. Device and app information, advertising identifiers, and ad interactions may be processed for ad delivery, measurement, and fraud prevention, and the Firebase UID and a reward-session identifier are sent to Google during server-side verification of rewarded ads.

5. Account Withdrawal and Retention

Users can withdraw in the app under Settings › Delete account (the MaroStory account page explains how to withdraw in the app). When withdrawal is complete, the user's Pipelody data stored on the MaroStory platform (purchased items and their claim and refund records, ownership such as Remove Ads, and rewarded-ad records) is deleted, sessions are revoked, and the Firebase Authentication account is deleted last. Unclaimed purchases and ownership such as Remove Ads cannot be restored after withdrawal; refunds follow the procedure of the store where the purchase was made. Game progress stays on the device and is deleted when the app is deleted. Payment records are kept separately only for the retention period in Section 3.

6. Cross-Border Transfer of Personal Information

Pipelody transfers personal information abroad as follows to provide the service. Transfers are made over encrypted networks when each feature is used.

Users who do not want their information transferred abroad may stop using the related feature or withdraw their account; in that case the related sign-in, purchase, or rewarded-ad features are unavailable.

7. Contact

Inquiries about Pipelody's handling of personal information and account withdrawal: help@marostory.com

Article 15 (Framed Archer Service-Specific Notice)

This Article applies to the Framed Archer app. Framed Archer processes the following information to provide archery gameplay, in-app purchases, and rewarded ads.

1. Account and Authentication

Without a separate sign-up or sign-in screen, the app connects to Firebase Authentication with the device's game account (Game Center on iOS or Google Play Games on Android), or as an anonymous guest if no game account is used. We process the Firebase user identifier (UID), sign-in provider information, and the game account identifier. We do not collect email addresses or passwords.

2. Game Progress

Game progress such as levels, coins, bow and arrow skins, and settings is stored only on the user's device and is not sent to the Company's servers. It is deleted from the device when the app is deleted.

3. In-App Purchases

Coins, Remove Ads, and the Starter Pack are purchased through Apple App Store or Google Play in-app payments, and only when the app is connected to a game account. Payment methods and card details are handled by each store and are not received by the Company. To verify purchases, deliver items, and process refunds, the Company processes the store transaction identifier, purchased product, amount, currency and country, purchase and refund times, payment environment (test or live), and the store-signed proof of purchase. Purchase verification, payment records, claim and refund records of purchased items, and ownership such as Remove Ads are handled on the Company's integrated platform (MaroStory, Google Cloud Seoul region). Only an account-linking value transformed so that it cannot directly identify the user's account is sent to the stores. Payment records are retained for five years from the date of purchase as required by law, including after account withdrawal, stored separately from other information, and then destroyed.

4. Advertising

Depending on consent and device settings, non-personalized ads are provided through Google AdMob and UMP; the app does not request App Tracking Transparency (ATT) permission. Device and app information, advertising identifiers, and ad interactions may be processed for ad delivery, measurement, and fraud prevention, and the Firebase UID and a reward-session identifier are sent to Google during server-side verification of rewarded ads.

5. Account Withdrawal and Retention

Users can withdraw in the app under Settings › Delete account (the MaroStory account page explains how to withdraw in the app). When withdrawal is complete, the user's Framed Archer data stored on the MaroStory platform (purchased items and their claim and refund records, ownership such as Remove Ads, and rewarded-ad records) is deleted, sessions are revoked, and the Firebase Authentication account is deleted last. Unclaimed purchases and ownership such as Remove Ads cannot be restored after withdrawal; refunds follow the procedure of the store where the purchase was made. Game progress stays on the device and is deleted when the app is deleted. Payment records are kept separately only for the retention period in Section 3.

6. Cross-Border Transfer of Personal Information

Framed Archer transfers personal information abroad as follows to provide the service. Transfers are made over encrypted networks when each feature is used.

Users who do not want their information transferred abroad may stop using the related feature or withdraw their account; in that case the related sign-in, purchase, or rewarded-ad features are unavailable.

7. Contact

Inquiries about Framed Archer's handling of personal information and account withdrawal: help@marostory.com

Article 16 (Postcard Metro Service-Specific Notice)

This Article applies to the Postcard Metro app. Postcard Metro processes the following information to provide subway-line gameplay, in-app purchases, and rewarded ads.

1. Account and Authentication

Without a separate sign-up or sign-in screen, the app connects to Firebase Authentication with the device's game account (Game Center on iOS or Google Play Games on Android), or as an anonymous guest if no game account is used. We process the Firebase user identifier (UID), sign-in provider information, and the game account identifier. We do not collect email addresses or passwords.

2. Game Progress

Game progress such as city records, stage progress and stars, coins, a run in progress (Continue), and settings such as language and sound is stored only on the user's device and is not sent to the Company's servers. It is deleted from the device when the app is deleted.

3. In-App Purchases

Remove Ads is purchased through Apple App Store or Google Play in-app payments, and only when the app is connected to a game account. Payment methods and card details are handled by each store and are not received by the Company. To verify purchases, deliver them, and process refunds, the Company processes the store transaction identifier, purchased product, amount, currency and country, purchase and refund times, payment environment (test or live), and the store-signed proof of purchase. Purchase verification, payment records, claim and refund records of purchases, and Remove Ads ownership are processed and managed on the Company's integrated platform (MaroStory, Google Cloud Seoul region). Only an account-linking value transformed so that it cannot directly identify the user's account is sent to the stores. Payment records are retained for five years from the date of purchase as required by law, including after account withdrawal, stored separately from other information, and then destroyed.

4. Advertising

Ads are provided through Google AdMob; personalized or non-personalized ads are shown depending on the consent collected through Google UMP and the device settings. On iOS, the app does not request App Tracking Transparency (ATT) permission. Device and app information, advertising identifiers (Android), ad interactions, and approximate location inferred from the IP address may be processed for ad delivery, measurement, and fraud prevention. During server-side verification of rewarded ads, the Firebase UID and a reward-session identifier are sent to Google, and reward confirmations are stored on the MaroStory platform.

5. Account Withdrawal and Retention

Users can withdraw in the app under Settings › Delete account (the MaroStory account page explains how to withdraw in the app). When withdrawal is complete, the user's Postcard Metro data on the MaroStory platform (purchases and their claim and refund records, Remove Ads ownership, and rewarded-ad records) is deleted, sessions are revoked, and the Firebase Authentication account is deleted last. Unclaimed purchases and Remove Ads ownership cannot be restored after withdrawal; refunds follow the procedure of the store where the purchase was made. Game progress stays on the device and is deleted when the app is deleted. Payment records are kept separately only for the retention period in Section 3.

6. Cross-Border Transfer of Personal Information

Postcard Metro transfers personal information abroad as follows to provide the service. Transfers are made over encrypted networks when each feature is used.

Users who do not want their information transferred abroad may stop using the related feature or withdraw their account; in that case the related sign-in, purchase, or rewarded-ad features are unavailable.

7. Contact

Inquiries about Postcard Metro's handling of personal information and account withdrawal: help@marostory.com

Article 17 (BingleRun Service-Specific Notice)

This Article applies to the BingleRun app. BingleRun processes the following information to provide running gameplay, in-app purchases, and rewarded ads.

1. Account and Authentication

Without a separate sign-up or sign-in screen, the app connects to Firebase Authentication with the device's game account (Game Center on iOS or Google Play Games on Android), or as an anonymous guest if no game account is used. We process the Firebase user identifier (UID), sign-in provider information, and the game account identifier. We do not collect email addresses or passwords.

2. Game Progress

Game progress such as video (chapter) progress, Likes (coins), gear, and settings is stored only on the user's device and is not sent to the Company's servers. It is deleted from the device when the app is deleted.

3. In-App Purchases

Likes (coins) and Remove Ads are purchased through Apple App Store or Google Play in-app payments, and only when the app is connected to a game account. Payment methods and card details are handled by each store and are not received by the Company. To verify purchases, deliver items, and process refunds, the Company processes the store transaction identifier, purchased product, amount, currency and country, purchase and refund times, payment environment (test or live), and the store-signed proof of purchase. Purchase verification, payment records, claim and refund records of purchased items, and ownership such as Remove Ads are handled on the Company's integrated platform (MaroStory, Google Cloud Seoul region). Only an account-linking value transformed so that it cannot directly identify the user's account is sent to the stores. Payment records are retained for five years from the date of purchase as required by law, including after account withdrawal, stored separately from other information, and then destroyed.

4. Advertising

Only non-personalized ads are provided through Google AdMob; the app shows no ad consent dialog and does not request App Tracking Transparency (ATT) permission. Device and app information, advertising identifiers, and ad interactions may be processed for ad delivery, measurement, and fraud prevention, and the Firebase UID and a reward-session identifier are sent to Google during server-side verification of rewarded ads.

5. Account Withdrawal and Retention

Users can withdraw in the app under Settings › Delete account (the MaroStory account page explains how to withdraw in the app). When withdrawal is complete, the user's BingleRun data stored on the MaroStory platform (purchased items and their claim and refund records, ownership such as Remove Ads, and rewarded-ad records) is deleted, sessions are revoked, and the Firebase Authentication account is deleted last. Unclaimed purchases and ownership such as Remove Ads cannot be restored after withdrawal; refunds follow the procedure of the store where the purchase was made. Game progress stays on the device and is deleted when the app is deleted. Payment records are kept separately only for the retention period in Section 3.

6. Cross-Border Transfer of Personal Information

BingleRun transfers personal information abroad as follows to provide the service. Transfers are made over encrypted networks when each feature is used.

Users who do not want their information transferred abroad may stop using the related feature or withdraw their account; in that case the related sign-in, purchase, or rewarded-ad features are unavailable.

7. Contact

Inquiries about BingleRun's handling of personal information and account withdrawal: help@marostory.com

Article 18 (Ticktown Lifts Service-Specific Notice)

This Article applies to the Ticktown Lifts app. Ticktown Lifts has no account sign-up, no ads, and no in-app purchases, and it does not communicate with the Company's servers. Game progress such as shift records, operating rules, and settings is stored on the user's device and backed up to the user's own iCloud (iOS) or Google Play Games saved games (Android) so it can continue after a device change or reinstall. The Company does not receive and cannot access this data. When Google Play Games is used, Google processes the gamer profile and saved games under Google's Privacy Policy. Users can erase progress on the device and in the cloud under Settings › Start over. Leaderboards and achievements are provided through Game Center (iOS) or Google Play Games (Android); scores and unlocked achievements are stored by Apple or Google and may be shown to other players on leaderboards together with the player's gamer name. The app purchase is processed by Apple App Store or Google Play, and the Company does not receive payment information. Contact: help@marostory.com

Article 19 (Ticktown Signals Service-Specific Notice)

This Article applies to the Ticktown Signals app. Ticktown Signals has no account sign-up, no ads, and no in-app purchases, and it does not communicate with the Company's servers. Game progress such as puzzle progress, signal plans, and settings is stored on the user's device and backed up to the user's own iCloud (iOS) or Google Play Games saved games (Android) so it can continue after a device change or reinstall. The Company does not receive and cannot access this data. When Google Play Games is used, Google processes the gamer profile and saved games under Google's Privacy Policy. Users can erase progress on the device and in the cloud under Settings › Start over (settings are kept). Leaderboards and achievements are provided through Game Center (iOS) or Google Play Games (Android); scores and unlocked achievements are stored by Apple or Google and may be shown to other players on leaderboards together with the player's gamer name. The app purchase is processed by Apple App Store or Google Play, and the Company does not receive payment information. Contact: help@marostory.com or account.marostory.com/ticktownsignals/support

Article 20 (Chief Privacy Officer)

The Company designates a Chief Privacy Officer as follows to take overall responsibility for tasks related to personal information processing and to handle complaints and damage relief of data subjects related to personal information processing. Chief Privacy Officer Officer: Soonoh Min Email: help@marostory.com Inquiries can be submitted through customer support within each service or via the email above.

Article 21 (Notification of Change)

This policy may be revised in response to changes in laws, policies, or Services. Material changes will be announced before they take effect through an in-Service notice, pop-up, or this website, and prior versions will be kept available upon request.

Inquiries Regarding Personal Information

Service Name: All services provided by MaroStory Company: MaroStory Email: help@marostory.com Department in Charge: Development Team

Privacy Infringement Report Center

If you need to report personal information infringement, you can report it to the following organizations:

• Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972
• Personal Information Infringement Report Center: privacy.kisa.or.kr / 118
• Supreme Prosecutors' Office Cyber Investigation Division: www.spo.go.kr / 1301
• National Police Agency Cybercrime Reporting System: ecrm.police.go.kr / 182

Announcement Date: August 27, 2026 Effective Date: August 27, 2026