Privacy Policy
Effective date: September 24, 2026
Last updated: September 29, 2026
Change summary: This policy reflects the unavailability of new ad-removal purchases and restoration in the current version, access protection for currently shared photos, and photo upload limits. Information about existing entitlements and Apple's purchase records is retained. Immediate revocation of previously issued URLs or cached responses is not guaranteed.
Minjeong Kong (JenKong), the operator of Custom Gomoku (the “App”), explains below what information the App processes, why it is used, and how it is retained and deleted.
1. Operator and contact
- Operator and privacy contact: Minjeong Kong (JenKong)
- Support and privacy inquiries: jenkong.dev@gmail.com
We use your email address, message and attachments to handle your inquiry. Do not send card numbers, passwords or authentication tokens. Unresolved inquiries are retained while being handled. Original emails and attachments are manually deleted on the last day of the month in which handling is completed. Retained operational records are limited to inquiry categories, solutions and counts, excluding names, email addresses, photos, user IDs and identifiable message text.
We review inquiries and reports once each day. For general inquiries, we aim to provide an initial response within three business days of receipt. This is not a guaranteed deadline for resolving an issue, and it does not replace report-resolution timelines or applicable statutory deadlines for rights requests.
2. Information stored on your device
The App stores the following information to retain settings, reconnect to games, limit advertising frequency and avoid counting the same game twice.
| Information | Purpose |
|---|---|
| Nickname, stone and board preferences, AI difficulty, language selection, and acceptance of the usage notice | Retain your preferences |
| Your selected and edited stone photo and its local file path | Display a custom stone |
| Online room identifier and authentication session information | Identify online participants and reconnect |
| Count of started games that ended or were left early | Determine eligibility for an interstitial ad |
| Time of the last interstitial display and the game count at that time | Record actual displays and enforce game-count intervals; timestamps do not impose a time interval |
| Identifier of the last counted game | Prevent duplicate counting |
On iOS, advertising frequency information is stored in UserDefaults and persists across app restarts. The App does not send these frequency records to Supabase. Information processed separately by advertising SDKs is described below.
Profiles and edited photos remain until changed or deleted. Advertising frequency records have no automatic expiry configured. Uninstalling the App can remove its local data, but the App cannot guarantee how device backups, restoration or OS-managed storage are handled.
3. Google AdMob advertising
The App uses Google AdMob for banner ads and interstitial ads. Each started game counts once when it ends normally or is left early. An interstitial opportunity occurs every five games after the last actual display. This game-count condition has no minimum playing time or minimum time interval between ad displays. However, a waiting period may apply before requesting another ad after an advertising error. Leaving before the first move still counts once a game has started; leaving a lobby, restoring a finished result, or merely backgrounding the App does not count.
Interstitials are never shown during play. They are offered on the result screen or home screen after departure only when ready and permitted by consent, purchase status and other display conditions. Unavailable or failed ads do not block navigation; the App retries at the next game ending or departure. An actual display may therefore occur outside an exact multiple of five; the next five-game interval starts from that actual display. Retroactive counting is not guaranteed if the App is forcibly closed before it can process an ending or departure.
Google's advertising SDK may process IP addresses (which may be used to estimate approximate location), app and device identifiers, crash and performance information, and ad impressions and interactions for advertising, measurement, diagnostics and fraud prevention. Non-personalized advertising does not mean that this processing is absent. See Google's advertising SDK data disclosure.
The App requests non-personalized banner and interstitial ads. It checks whether Google UMP (consent management) permits ad requests before requesting ads. Tapping Advertising Privacy Choices in settings refreshes consent information and opens the privacy options form when the SDK indicates that it is required. Otherwise, the App explains that the form is not required or is unavailable. After the form closes, the latest SDK ad-request permission is applied. The web version does not request ads or offer this form.
See the Google Privacy Policy for Google's practices.
The App uses Google AdMob / User Messaging Platform for advertising and consent management, Apple StoreKit for checking existing purchase entitlements, and Supabase for online features. When user data is shared with these services or processed by their SDKs, the operator requires them to provide privacy protection consistent with this policy and applicable privacy requirements, and equal to or greater than the protection described in this policy. These services are used according to their respective roles and applicable terms of service and data processing terms. Details of their processing are described in the relevant sections of this policy and in each service's privacy policy.
4. Purchases unavailable in this version and existing entitlements
The current version does not offer new ad-removal in-app purchases or purchase restoration, and does not display purchase or restore buttons. Banner and interstitial ads are both suppressed if an existing valid ad-removal entitlement is confirmed.
Neither the App nor its operator directly collects or stores payment-method details such as your credit card number. The App processes verified transaction and entitlement information supplied by Apple StoreKit 2 to check existing entitlements. A locally stored purchase flag alone is not used to establish ownership.
Existing entitlements are checked at startup and during purchase-state refreshes. Transaction updates reflect changes such as revoked entitlements. These checks of existing entitlements do not mean that a user-initiated purchase restoration feature is available. The App does not send StoreKit transactions to Supabase.
Deleting App data does not delete Apple's purchase records or request a refund. See the Apple Privacy Policy for Apple's handling of payment and transaction information.
5. Online play and Supabase
When online play is configured and used, the App uses Supabase for authentication, database storage, real-time game synchronization and photo storage. It may create an anonymous authentication account for online use. Such an account still has a unique identifier; “anonymous” does not mean that all associated information is anonymized.
Processed information includes participant identifiers, nicknames, selected stone themes, edited photo storage paths, room identifiers and joining codes, participation and last-seen information, and game state such as moves, turns, winners and rematch votes. Supabase may also process network and service logs while providing these services.
Room participants can see the nicknames, stone photos and game state needed to play. New reads and URL issuance for currently shared photos in private storage check participation in the same room and the photo owner's participation status. New access to previous or unused photos, departed participants' photos, other rooms' photos, and suppressed photo paths is restricted. Previously issued URLs, cached responses or downloaded copies may not be immediately revoked, and replacing a photo does not itself delete the previous server file. Custom photos are not uploaded to Supabase merely for local single-player play.
Photo uploads are allowed only to the user's own path in a room they participate in while it is waiting for play. Only JPEG files using the prescribed path of room, user and file identifiers are accepted. The maximum file size is 512 KiB. Stored files are limited to 32 per user in a room, 64 per user across rooms, and 128 across all users in a room. Smaller files and previous files no longer shared also count toward these limits. Reaching a limit may prevent new uploads or photo replacement; applying a limit does not itself delete existing files. Suppressed photo paths cannot be registered in a profile again.
The database project used for online games and photo storage is located in Seoul, South Korea. This does not mean that all authentication, support, log, backup or advertising processing takes place only in South Korea. See the Supabase Privacy Policy.
6. Photos, reports and blocking
The operator directly reviews server reports and related photos from Canada to investigate reports and take user-protection measures. This information is therefore accessed and processed in Canada.
Photos are optional; you can play with default stones. The App uses the system photo picker to let you select and edit a photo, then stores a 512×512 JPEG stone image on your device. That edited image is uploaded when your profile is published to an online room. The App removes unnecessary JPEG metadata, including EXIF, XMP, IPTC, comments and embedded thumbnails, immediately before upload while retaining the colour profile. It does not remove faces or text visible in the image. This is processing by the normal App upload path, not automatic server inspection of every upload or automatic filtering of inappropriate images. This does not upload your entire photo library or the selected original file itself.
iOS keeps edited photos as files in the App's document storage. The web version stores edited image data with the profile in browser storage, so descriptions of file paths and file deletion refer to the iOS implementation.
Replacing your photo or switching to a default stone deletes the previous profile photo file stored by the App. Photos already published to an online room are subject to separate server deletion and cleanup procedures. Images already downloaded or captured by another participant cannot be remotely recalled.
A report stores the reporter, target and room identifiers, report reason and time, and the photo path at the time of reporting. Blocking stores the blocking relationship and leaves the room. These records support user protection and report handling. Server administration functions also exist to suppress photo paths and hide photos from games.
Reports are reviewed once each day. The initial-response target for general inquiries is not a deadline for resolving reports. Outcomes are explained when a contactable reporter asks; no automatic email is sent. Photo-suppression records restrict access to the corresponding path and are not automatically removed with related photos or rooms until conditions preserving this protection have been verified.
7. ATT and IDFA
The iOS App has no direct feature requesting App Tracking Transparency (ATT) authorization or reading the advertising identifier (IDFA). Access to IDFA is restricted by iOS tracking permission. Advertising privacy choices and ATT authorization are separate processes.
The App disables Google's Publisher First-Party ID feature before initializing the advertising SDK on iOS. This setting and the App's lack of direct IDFA use do not stop all data processing by the advertising SDK. Google Mobile Ads SDK may process IP addresses, app- or developer-scoped identifiers, diagnostics, performance information and ad interactions while providing advertising. The App includes Apple's SKAdNetwork configuration, which supports ad install attribution without IDFA. Non-personalized ads and the absence of an ATT prompt do not mean that all identifier processing or measurement is absent. See Google's iOS privacy guidance.
8. Retention and deletion
Cleanup of inactive rooms and related photos is scheduled daily at 07:00 UTC. Deletion depends on the conditions below and successful execution; it is not guaranteed to occur immediately after the time threshold.
| Category | Retention and deletion |
|---|---|
| Local profile, edited photos and room information | Removed through changes or the App's Delete My Data function. |
| Ad counts, display times and counting identifiers | No automatic expiry. Delete My Data clears these records. Existing purchase records held by Apple and advertising SDK consent records are preserved. |
| Inactive online rooms and related photos | Daily at 07:00 UTC, cleanup examines up to 100 rooms last updated more than 24 hours ago. Rooms with participant activity in the last 24 hours, games still in progress, and rooms linked to reports are excluded. Once claimed for cleanup, a room cannot be rejoined; associated photos and membership records are removed. Previously archived rooms may also be retried after interrupted cleanup. Deletion depends on eligibility and successful execution; deletion within 24 hours is not guaranteed. Failed cleanup is retried on subsequent runs and reviewed by the operator. |
| Report records | Reports whose handling and review have concluded are manually deleted on the last day of that month. Unresolved reports and reports requiring retention are excluded; the reason for retention and a review date are recorded. Reports are not automatically deleted merely because 30 days have passed since creation. This is a separate manual procedure from inquiry email cleanup. |
| Anonymous accounts, blocking relationships and photo-suppression records | No automatic inactivity detection or expiry exists. Users can request Delete My Data, and some related records are removed with the account. Photo-suppression records are separate and are not automatically removed merely because the photo or room is deleted. |
| Server and advertising service logs and backups | Managed separately by the providers. Delete My Data does not immediately delete provider logs or backups. The separate month-end rule for inquiry emails is described in section 1. |
Settings → Delete My Data requests deletion of the online account and associated photos when an online authentication session is available. Active rooms are left first. In remaining rooms, the nickname is replaced with “Deleted participant” and the photo reference is removed. Identifiers and moves needed for game continuity, report content and photo paths, and certain other records may remain until separate cleanup. Complete, immediate anonymization of all related information is not guaranteed.
If server deletion fails, the local profile and photos are retained so you can retry. Completing deletion requires a network connection and working server functions. If you cannot access the online session, contact the email below; verifying ownership of an anonymous account may be necessary.
Deletion takes place in several steps. An error may occur after some data has already been deleted, and you may need to retry to finish deleting the remaining data. If the problem continues, please contact the support email.
Delete My Data clears the local profile, stone photos, room information and advertising frequency records. On iOS it also resets the language selection; the web version retains that selection. Existing purchase records held by Apple and advertising SDK consent records are retained. Account-linked membership, theme and user-blocking relationships are removed with account deletion, but game history, reports and photo-path suppression records may remain as explained above.
9. Your choices
- Use default stones instead of a photo.
- Change your nickname, photo, stone and board preferences.
- Review available advertising privacy choices in settings.
- Report or block participants, use Delete My Data, or contact support.
- Manage relevant App permissions in your device settings.
For inquiries about access, correction or deletion of personal information, contact the support email. We will explain available procedures according to the request, account verification and applicable requirements.
10. Audience and protection inquiries
The App supports custom photo stones and invitation-room play without a registration screen. The current App does not ask for age or residence at startup or when joining an online room. It has no public matchmaking, public photo feed or public profiles. Someone with an invitation code is not necessarily a real-world friend or guardian.
Advertising privacy choices and App Store content ratings do not replace parental privacy consent. The App has no age or parental-consent verification process. Please contact support with inquiries or deletion requests concerning children's or teenagers' photos or personal information.
11. Policy changes
This policy and its last-updated date will be revised when functionality, processing or operational policies change. Significant changes will be described on this page with the change date and a summary. Page publication alone is not treated as sufficient where separate notice or renewed consent is required.
12. Contact
Operator and privacy contact: Minjeong Kong (JenKong)
Support and privacy inquiries: jenkong.dev@gmail.com