Privacy Policy

Effective date: November 13, 2026 · Operator: Beyond Imagine (미지의 상상)

This policy explains what personal information Beyond Imagine (미지의 상상) ("we") processes when you play Crazy Express (the "game") on iOS or Android: what we collect, why, how long we keep it, how we destroy it, who else receives it, and how you can use your rights.

1. What we collect

We do not ask for your name, email address, phone number, contacts or precise location, and we never receive your card or bank details. We collect the following automatically while you play:

Account

• Account ID: a random identifier created the first time you open the game. You play as a guest under this ID.
• Platform (iOS or Android) and the time the account was created.
• Sign in with Apple / Google (optional): if you link Apple or Google to keep your progress across devices, we receive a sign-in token from them and store only the stable user identifier it contains (the "subject" ID). We do not store your email address, name or profile picture. For Sign in with Apple we also keep the token Apple issues for your link, only so that we can revoke it at Apple when you delete your account.
• Reinstall restore: until you link a sign-in, a small record (your account ID and a sign-in token) is kept on your device in the iOS Keychain or Android Block Store so a reinstall on the same phone can restore your guest account. It is not backed up to the cloud and is removed when you link a sign-in.

Game data

• Progress and save data: stages cleared, scores, coins, gems and other in-game items, cars and cosmetics, settings needed for play, and the nickname you choose.
• Play activity: on which days since sign-up your game synced, whether the tutorial is done and your furthest stage. We use it only in aggregate statistics (for example, how many players reach a world).
• Leaderboard: your nickname, selected skin and best distance in each season. These are shown to other players.
• Run results and fair-play checks: results of each run (time, distance, coins, etc.) are checked by the server; results that look impossible are recorded together with the account ID to fight cheating.
• Paid-currency history: a record of changes to your gems (what, when, why), kept for customer support and refunds.
• Leaderboard reports: if you report a nickname, we store your account ID, the reported player's nickname as shown and the reason, so we can review it.

Device and security checks

• Device integrity checks: to keep results and purchases fair, the game asks Google Play Integrity (Android) or Apple App Attest (iOS) for a signed statement that requests come from the genuine app on a genuine device. We store the result (and, on iOS, the public key App Attest creates for your installation); Play Integrity may also report a coarse level of recent activity on the device. We do not receive your device's hardware identifiers from these checks.
• Per-installation signing key: each installation of the game gets a random device ID and a key derived from it, which signs your offline results so they can't be altered on the way, and lets an unlinked guest prove the account is theirs if its sign-in is lost. We store the device ID and its progress counters, not the key.

Purchases

• Payments are processed by Apple (App Store) or Google (Google Play).
• We receive and store the store's transaction / order ID, the product, the time, charged amount and currency, store settlement status and refund status, and ask the store to confirm the purchase belongs to your account ID.

Campaign links and referral codes

When you open a registered campaign link, we count visits and store-button clicks by campaign and day, including repeat visits. These counters do not identify individual visitors. On Android, the game reads a campaign code from Google Play's install referrer when available; you can also open a campaign link in the installed app or enter a code in Settings. We send only the code to our server, where the first accepted code and its acceptance time are linked to your game account. We use that link with existing account and purchase records to measure sign-ups, purchasing accounts and valid purchase amounts by campaign. We do not use this feature to collect advertising IDs, retain raw referrer URLs or individual visitor IP addresses, or share account-linked results with campaign publishers.

Completion notifications

We use Google Firebase Cloud Messaging (FCM), and Apple Push Notification service on iOS, to notify you of purchase, refund, reward and support updates. We store the FCM address with your account ID, signing-device ID, a random installation ID, registration/session counters, platform, language, update time and last notified state version. The delivery services process installation identifiers and, on iOS, the APNs token. Notifications contain a general message and your random account ID, state version and update category, not payment details or reward amounts.

You can decline or disable visible alerts in your device settings. Messaging software can register an installation before the alert permission prompt; disabling visible alerts does not itself stop all SDK identifier processing. Opening the game still synchronises your purchases and rewards.

Advertising

• The game shows interstitial ads between runs and optional rewarded ads through Google AdMob and its mediation partners Meta Audience Network, Pangle (ByteDance), Unity Ads and Liftoff Monetize (Vungle). Their software in the game loads ads while you are online.
• These partners collect information directly from your device under their own privacy policies, which may include your device's advertising ID (IDFA on iOS, Google Advertising ID on Android), IP address, device and app information, and how you interact with ads. They use it to show and measure ads, to prevent ad fraud and, where allowed, to personalise ads.
• iOS: the game asks for permission to track (App Tracking Transparency). If you decline, your IDFA is not shared.
• Where the law requires consent for personalised ads, the game asks for it through Google's consent message before such ads are shown; when the game offers privacy options in Settings, you can change your choice there.
• When you finish a rewarded ad, Google sends our server a signed confirmation containing your account ID, the reward type and a transaction ID so the reward can be granted. We do not receive the advertising ID.

Logs and error reports

• Our servers run on Cloudflare, which processes your IP address and request information (time, address requested, app version) to deliver the service and protect it from abuse, including rate limiting.
• If the game hits an error it may send an error report: the error message and a shortened stack trace, app build, platform, OS version, device model, the screen in use, your account ID (if signed in) and the country of your network (derived by Cloudflare from your IP address; the IP address itself is not stored with the report).

Diagnostics and audience measurement

Firebase Crashlytics (Google LLC) receives native crash reports and redacted Unity error messages, stack traces, app/build, OS and device information, and app-installation identifiers. We do not set a game-account ID, email or purchase token in Crashlytics. Its crash data and associated identifiers are retained for 90 days before removal begins, under Firebase's privacy terms.

For support and audience statistics, we store the latest app language, device locale, time-zone name, UTC offset, platform, build and observation time with your account. Test-device hints, sandbox purchase/install signals, verified Google test-email pattern flags and Google/Apple network flags help exclude test traffic. We retain flags, not the email or IP address, for this classification. These signals are estimates and an administrator can correct them. They do not determine purchase rights. Account-linked environment and classification data are removed when the account is deleted; full recovery backups expire under the backup schedule above. Anonymous daily stage totals are kept for up to 365 days. No GPS location is collected for this purpose.

Web account deletion requests

• If you use the web deletion request page: the account ID you enter, the page language and, only if you give one, an email address to reach you.

Playing offline

Most of the game can be played offline: your progress is kept on your device and sent to our server the next time you are online.

2. Why we use it

• To provide the game: keep your progress on our server, restore it on a new device, run leaderboards and seasons.
• To deliver purchases, handle refunds and keep the records the law requires.
• To keep the game fair and secure: detect cheating, receipt reuse and abuse, and review leaderboard reports.
• To show interstitial and rewarded ads, and grant confirmed rewarded-ad rewards.
• To fix bugs and improve the game, using error reports and aggregate statistics.
• To measure which campaign links lead to sign-ups and purchases, using the referral data described above.
• To answer your requests, including account deletion, and send service-completion notifications.

We do not sell your personal information and we do not use it for automated decisions that have legal effects on you.

3. How long we keep it

• Account and game data: until you delete your account. Saves untouched for 180 days are moved to archive storage and restored when you return.
• When you delete your account, your save, nickname, leaderboard entry, sign-in links and sign-in sessions are deleted right away (archive copies included).
• Purchase records and the paid-currency history are kept after deletion under the bare account ID, without your sign-in links: for 5 years, as the Korean Act on Consumer Protection in Electronic Commerce requires for payment records, and for refunds and accounting.
• Fair-play records: as long as the account exists (notes without penalty points: up to 90 days). When you delete your account, notes are deleted and records that carried penalty points are kept only as anonymous counts (kind, points, time) without your account ID or any details.
• Leaderboard reports: until the reporter's or the reported player's account is deleted.
• Backups: a weekly copy of account, sign-in link, purchase, paid-currency and admin records is kept for up to 12 weeks, and the database keeps up to 30 days of history, both only to recover from failures. A deleted account leaves them as they expire.
• Notification addresses: removed after 90 days without renewal; installation registration/opt-out markers after 180 days. Both are deleted when the account is deleted. They are excluded from the weekly backup, but may remain in database recovery history for up to 30 days.
• Campaign visits and store-click totals: kept by day for 90 days and removed by daily maintenance. Your first referral code and acceptance time: kept with your account until account deletion, and also removed if the account is designated for store review. These records are excluded from the weekly auxiliary backup, but database recovery history may retain them for up to 30 days. A pending code may remain on your device until the server accepts or rejects it.
• Server logs and error reports: up to 7 days.
• Web deletion requests: up to 1 year after the request is handled.

4. How we destroy it

• When a retention period ends or the purpose is fulfilled, we delete the information without delay. Electronic records are deleted from our database and storage so that they cannot be restored; we keep no paper records.
• Records the law requires us to keep (purchase and paid-currency records) are kept apart from your game data, used only for that purpose, and deleted when their period ends.

5. Sharing with third parties

We do not give your personal information to third parties, except:

• the ad partners in section 1, whose software collects information directly from your device while the game shows ads (details in section 7);
• Apple and Google, with whom you deal directly when you sign in, buy something or pass an integrity check (details in section 7);
• when the law requires it, for example a lawful request from an investigative authority.

6. Processors

• Cloudflare, Inc. — server hosting, database, file storage and logs, on our behalf.
• Google LLC (Firebase Crashlytics) — crash diagnosis and app stability.
• Google LLC (Firebase Cloud Messaging) — delivering service-completion notifications.

If we add or change a processor, we will update this policy.

7. Transfers outside Korea

Our server provider and partners are companies abroad whose servers may be outside Korea, so the information below may be transferred abroad. It is sent over encrypted network connections while you use the game online.

• Cloudflare, Inc. (USA; privacyquestions@cloudflare.com) — where: the United States and other countries where Cloudflare runs data centers; what: everything in section 1 that our server receives; why: hosting and storing the service; how long: as in section 3.
• Apple Inc. (USA) and Google LLC (USA) — what: sign-in tokens, purchase transaction IDs with your account ID, integrity check tokens, and (Apple) the sign-in link token we revoke on deletion; when: when you sign in, buy something, pass an integrity check or delete your account; why: to verify sign-ins, purchases and integrity checks; how long: under Apple's and Google's privacy policies.
• Google LLC (FCM, USA) and Apple Inc. (APNs, USA) — notification/installation identifiers, delivery metadata and the notification content described above are transferred when registering or delivering notifications, to provide the messaging service, under their respective retention and privacy policies.
• Google LLC (AdMob, USA), Meta Platforms, Inc. (USA), Bytedance Pte. Ltd. (Pangle, Singapore), Unity Technologies (USA) and Liftoff Mobile, Inc. (USA) — what: advertising ID, IP address, device and app information, ad interactions; when: when the game loads or shows ads, collected by their software in the game; why: showing and measuring ads, preventing ad fraud and, where allowed, personalising ads; how long: under each company's privacy policy, where you can also contact them.

How to refuse: you can play offline, which sends nothing; you can decline tracking on iOS and reset or delete your advertising ID in your device settings, after which ads are not personalised; and you can delete your account. Without the transfer to Cloudflare, saving to our server, purchases, rewarded ads and leaderboards do not work.

8. Your rights

• You (or your legal representative) may ask to access, correct or delete your information, to stop processing it, or to withdraw consent, by emailing crazyex@mzss.app. We will reply within 10 days. Include your account ID (shown in the game's Settings).
• Delete your account in the game: Settings → Delete account. Deletion is immediate and cannot be undone.
• On the web: if you no longer have the game, use the account deletion request page.
• For help with a privacy problem in Korea you can also contact: the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office cybercrime unit (1301) or the Korean National Police Agency cyber bureau (182).

9. Children

The game is not directed at children under 13 (under 14 in Korea), and we do not knowingly collect personal information from them. If you believe a child has given us information, contact us and we will delete it.

10. Security

• All data travels over encrypted connections. Offline results are signed so they can't be altered on the way.
• Sign-in tokens are short-lived and single-use where possible. We store no passwords.
• Only authorised staff can open our admin tools, through a separate sign-in, and every change they make is logged.
• We keep only the information listed in this policy, and data is stored in Cloudflare's data centers, which are physically protected by Cloudflare.

11. Cookies and similar technology

These web pages use no cookies or persistent visitor identifiers. A first-party script selects device-appropriate store links and shows QR codes. We count link clicks, QR opens and store redirects by day, page language, link position, destination, device category and campaign; these aggregate counts are retained for up to 90 days. We do not include account IDs, IP addresses or full browsing URLs in these counters. Do Not Track and Global Privacy Control disable this optional counting. In the game, the ad partners use your device's advertising ID as described in section 1; you can reset or limit it in your device settings.

12. Privacy officer and contact

Privacy officer: Customer Support
Email: crazyex@mzss.app
Beyond Imagine (미지의 상상)

13. Changes

If we change this policy, we will post the new version on this page at least 7 days before it takes effect and change the effective date above; for significant changes we will also tell you in the game.