Privacy Policy

Effective: 13 August 2026

[Draft] This English edition is being prepared for the international service and is under legal review. It applies to accounts registered on the international service.

Joytalk ("we", "the Operator") operates Joytalk Online. This policy explains what personal data we process, why we process it, how long we keep it, who we share it with, and what rights you have.

1. Who is responsible for your data

Controller: Joytalk (representative: Junhyuk Yang), Republic of Korea
Contact for privacy matters: support@joy-talk.com
EU / UK representative: [to be appointed]

2. What we collect

When you create an account and use the service:
1. Required: username, password (stored only as a hash), nickname, date of birth (to confirm your age).
2. Optional: email address.
3. If you sign in with Google or Apple: the unique account identifier that provider gives us, and — where you agreed to share them — your email address and display name.
4. When you play the game: device identifier, push notification token (if you turned notifications on), and your in-game character and play records.
5. Collected automatically: IP address, cookies, times of access, usage records, browser type and operating system.
We do not collect location data, and we do not collect national identification numbers.
We collect this data when you enter it yourself (registration, posting), automatically as you use the service, and when you write to us.

3. Why we process it, and on what legal basis

Purpose	Legal basis (GDPR Art. 6)
Creating and running your account; identifying you; providing the game and the community boards	Performance of a contract — Art. 6(1)(b)
Confirming you are old enough to register (16+)	Legal obligation and legitimate interests — Art. 6(1)(c), (f)
Handling enquiries and complaints	Performance of a contract; legitimate interests — Art. 6(1)(b), (f)
Protecting users: automated screening of uploaded images and chat for obscene material, image-based sexual abuse material, child sexual abuse material and abuse; handling reports; restricting accounts	Legitimate interests in keeping users safe, and legal obligation — Art. 6(1)(f), (c)
Preventing fraud and abuse of the service	Legitimate interests — Art. 6(1)(f)
Marketing messages about new features, events and offers	Consent — Art. 6(1)(a). Optional; you can withdraw at any time

Where we rely on legitimate interests, we have considered whether those interests are overridden by your interests and rights. You may object to that processing — see section 7.

4. Automated screening of images and messages

Images and chat messages you send are screened automatically so that obscene material, image-based sexual abuse material and child sexual abuse material are not delivered to other users.

What is sent — a copy of the image reduced to no more than 512 pixels on its longest side, and the text of the message. Embedded metadata such as capture location and device (EXIF) is removed during that reduction and is not sent. Your name, username and other identifiers are not sent with it.
When — at the moment you upload an image or send a message.
Retention — the processor's use ends as soon as the result is returned, and the processor does not use this material to train artificial intelligence models.
Can you refuse? — if you do not use the image and chat features, nothing is sent. Because the screening protects other users, it cannot be switched off while those features are used.
The screening decides whether material is blocked. If you believe your material was blocked wrongly, write to us and a person will review it — see section 7 on your right not to be subject to a solely automated decision.

5. How long we keep it

Account data — until 30 days after you close your account. Access stops immediately on closure; we hold the data for 30 days to prevent abuse and fraudulent re-registration, then erase it without delay.
Posts and comments — until you delete them. They remain published, with the nickname attached, after an account is closed. If you want them removed, delete them before closing your account, or ask us.
Records of abuse of the service — 1 year.
Login records — 3 months.
We keep data for longer only where we must: while an investigation or legal proceedings are under way, or while a debt between us remains to be settled.

6. Who we share it with

We do not sell your personal data, and we do not share it for anyone else's marketing.

We use the following processors on our behalf:

Processor	What they do	Where
Amazon Web Services	Sending email (sign-up verification, password reset and similar)	Republic of Korea (Seoul region)
Apple Inc.	Push notifications to iOS devices (APNs) — only if you turned notifications on	United States
Google LLC	Push notifications to Android devices (FCM) — only if you turned notifications on	United States
OpenAI, L.L.C.	Automated screening of uploaded images and chat (section 4)	United States

We disclose data to public authorities only where the law requires it.

7. Transfers outside your country

We operate from the Republic of Korea, and some of our processors are in the United States. Where your data leaves the European Economic Area or the United Kingdom, we rely on:

the European Commission's adequacy decision for the Republic of Korea, for data held on our own systems; and
Standard Contractual Clauses with processors in countries not covered by an adequacy decision. [to be confirmed per processor]

You can ask us for a copy of the safeguards that apply by writing to support@joy-talk.com.

8. Your rights

You have the right to:

ask what personal data we hold about you, and get a copy of it (access);
have inaccurate data corrected (rectification);
have your data erased (erasure);
have our processing restricted while a question about it is resolved (restriction);
receive the data you gave us in a portable, machine-readable form, and have it sent to another controller where technically feasible (portability);
object to processing we carry out on the basis of legitimate interests, including profiling (objection);
withdraw consent at any time, where we relied on consent. Withdrawing does not affect processing done before you withdrew; and
not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Where automated screening blocks your material, you may ask for a person to review it.

Write to support@joy-talk.com to exercise any of these. We respond within one month; where a request is complex we may extend that by two further months and will tell you if we do. Exercising these rights is free.

You may also complain to the data protection authority in the country where you live or work. Doing so does not stop you from also contacting us.

9. Children

You must be 16 or older to register. We do not knowingly collect personal data from anyone under 16. If we learn that we have, we erase it without delay. If you believe a child under 16 has registered, write to support@joy-talk.com.

10. Cookies

We use cookies that are necessary for the service to work — keeping you signed in and protecting forms against cross-site request forgery. You can block or delete cookies in your browser settings, but if you block the necessary ones you will not be able to stay signed in.

Analytics: [pending — see review note before launch]

11. How we protect your data

Organisational: an internal handling plan, and regular training for staff who handle personal data.
Technical: passwords are stored only as hashes and are never recoverable; traffic is encrypted in transit (HTTPS); access to personal data is limited to those who need it; access is logged.
Physical: servers are held in access-controlled facilities.

12. Changes to this policy

Where we change this policy, we publish the new version here with its effective date, at least 7 days before it takes effect — or at least 30 days before, where the change is unfavourable to you.

Addendum

This policy takes effect on 13 August 2026.