BEATWAVE Privacy Notice

Scope of this notice

This is an English translation of the BEATWAVE provisions and applicable shared rules in the Korean privacy policy revised on 3 October 2026. It does not describe other NINE TO SIX LAB apps. The web playtest, Android, iOS and Toss versions handle different information; use the section for your platform.

The website and blog have separate analytics and advertising rules. This privacy page and the BEATWAVE support, deletion and terms pages do not run advertising or visitor-analytics scripts. Game records are not sent to the website’s analytics.

1. Web playtest

Game settings and progress are stored in the browser you use. If you use online rankings, an anonymous identifier, automatically generated display name, play settings and scores are stored on the ranking server. The display name, rank, combined score and number of cleared songs may be public. Clearing browser data removes local browser records.

2. Android accounts and game records

The ONEstore version launched on 24 September 2026. As checked on 3 October, Google Play version 1.0.4 is public in Korea; 1.0.5 is under review. App availability and validation of every commercial transaction are separate matters.

Google sign-in and Supabase Authentication identify accounts. The Google account identifier, email address, name (name/full_name) and profile-image URL (picture/avatar_url) received during sign-in are stored in Supabase Auth. The name and photo URL are received as account information but are not currently used in the game interface. The game uses a default display name and does not display the Google profile image. BEATWAVE does not collect your Google password.

Google Play includes sign-in for review/support accounts issued by the developer outside the app. The email and password entered for that account are sent to Supabase Auth for authentication. They are not stored in plain text in game or purchase records. This password is separate from the Google password. General users cannot create an email/password account inside the app; they use Google sign-in.

Supabase stores account-linked settings and profiles, play records, scores and progress, play-credit balances and top-up/use history, mailbox delivery/claim status, and cosmetic or monthly-pass entitlements.

Public rankings show the game display name, rank, score and cleared-song count. They do not display the Google name, email or profile-image URL. Accounts designated for review are excluded from public rankings by the server.

3. Android purchases and refunds

ONEstore

The released version offers monthly passes, play credits and cosmetic purchases. The app sends the purchase token and product ID to the verification server. The server checks purchase time, status, subscription expiry and refund/cancellation status with ONEstore’s purchase API before granting or revoking an item. Tokens are retained for fraud prevention, restoration and refunds and are not shown again in the app. See ONEstore’s developer documentation.

ONEstore handles card, bank-account and other payment-method information; BEATWAVE does not collect or store it directly. Records that legally require retention, such as contracts/withdrawal, payment and supply records, may be retained separately for five years.

Google Play

Purchases are linked to the BEATWAVE account described above. The server handles the Google order ID, product ID, purchase token, entitlement/subscription expiry and purchase/cancellation/refund status. It checks Google Play purchase information to verify grants, prevent duplicate grants, restore purchases, renew entitlements and apply refunds. Related records are stored in Supabase.

Google Play handles payment-method information. BEATWAVE does not collect card details or Google passwords. Where actual transactions create statutory retention obligations, contract/withdrawal and payment/supply records are kept separately for five years; consumer complaints/dispute records are kept for three years, then destroyed. These rules are based on Article 6 of the Enforcement Decree of the Korean Act on Consumer Protection in Electronic Commerce, etc.

ONEstore refund and subscription enquiries

ONEstore and the seller consider refund eligibility using platform rules, product use and actual transaction status. In the ONEstore app, open MY → Purchase history → receipt icon to find the electronic receipt number (TxID). Follow ONEstore’s refund instructions (Korean) or contact its support at 1600-6573 or cscenter@onestore.co.kr. For in-game delivery/revocation checks, email ysmilk01@gmail.com with the TxID.

To stop the next monthly renewal, select the BEATWAVE subscription in ONEstore → MY → Subscriptions. Cancellation stops automatic renewal from the next payment date. Access for an already-paid period follows the expiry and transaction status shown by ONEstore. Menus may differ by app version or transaction status.

Account deletion and store-subscription cancellation are separate. If you subscribed through Google Play, follow Google Play’s cancellation guide. See the deletion page for the email request process.

4. Android rewarded ads

The ONEstore and Google Play Android versions use Google Mobile Ads SDK 25.5.0 and User Messaging Platform (UMP) SDK 4.0.0. For ad delivery, measurement, analytics and fraud prevention, Google’s SDK may automatically collect/share IP addresses, app interactions such as launches, taps and video views, SDK diagnostics, device/account identifiers and the Android advertising ID when available. See Google’s Android SDK data disclosure.

Rewarded ads are requested when you choose to watch. Both Android versions create an account-specific reward-request ID before viewing. After completion, the same server-verification flow checks Google’s signed transaction ID and completion time. These identifiers and times are stored to prevent duplicate grants. Play credits are granted only after signature verification and daily reward-limit checks.

Google UMP checks whether a consent or privacy-options screen is required for the region. You can reopen the available choices in the app’s ad-privacy settings. This notice applies to Android, not the web playtest. Actual ad availability depends on the provider. Payment processing follows the store used.

On Android, if you do not want personalised advertising, you can delete or reset the advertising ID in Settings → Privacy → Ads. Ads may still appear, but interest-based personalisation is stopped as described in the existing policy.

5. iOS accounts, storage and purchases

As checked on 3 October 2026, the public Korean App Store version is 1.0, and build 39 provides no ads. The optional rewarded-ad rules below apply from the 1.0.1 update, which is under review. They do not mean that the current build already serves ads. Basic play is available without ad consent.

Guest play and optional sign-in

“Play without signing in” does not require registering a name, email or password. If the account server is reachable, Supabase Authentication creates an anonymous guest identifier and links game records and entitlements to it. Google or Apple sign-in is optional. Guests can view App Store products, purchase, restore purchases and use the mailbox, subject to Apple’s actual product/transaction information and server checks.

If the account server cannot be reached and the game uses device-only storage, basic-play records remain on the device and purchases are unavailable. Clearing storage or uninstalling may make device-only records unrecoverable.

Authentication information

Guests use Supabase anonymous authentication and may link Google or Apple sign-in. Google sign-in may include an account identifier, email, name and profile-image URL. Apple sign-in uses an account identifier and email; Hide My Email uses Apple’s relay address. The app does not request Apple name permission and does not receive Google or Apple passwords.

Authentication sessions are stored in iOS Keychain. Separately issued review/support accounts send their email and account password to Supabase Auth. This is not the Google/Apple password and is not a public email-registration feature. A refresh token needed to revoke Apple sign-in is encrypted on the server and used for revocation during account deletion. Token values are not exposed on screen or in public API responses.

Game records and purposes

The BEATWAVE-specific area of Supabase processes identifiers linked to guest or Google/Apple accounts; profiles and settings; progress, scores and rankings; play credits and usage; mailbox grant/claim records; and product entitlements. These support saving/restoring accounts, gameplay and prevention of duplicate purchases/rewards. Public rankings use the game display name, score, rank and cleared-song count, not the login email or Google photo.

Apple in-app purchases

The payment-server connection is active. Monthly-pass/play-credit purchases and grants were checked in Apple’s Sandbox. Real commercial transactions have not yet been fully verified; test payments are not presented as validation of general users’ real purchases.

StoreKit and server verification process product identifiers, transaction/original-transaction IDs, an identifier linking the purchase to the game account, purchase time, subscription expiry and refund/cancellation/entitlement status. Apple-signed transactions and server queries are checked to grant, restore, renew and refund entitlements, and related records are retained. Apple handles payment-card and bank-account information; BEATWAVE does not store it directly.

6. iOS optional rewarded ads — from 1.0.1

Only after you choose to watch a rewarded ad and agree to provide ad-related information does the app begin Google UMP consent checks, initialize the Google Mobile Ads SDK and request an ad. Regions requiring additional Google consent/privacy choices receive those screens. You can use basic play and purchases without this consent. No viewing reward is granted if you decline or do not complete the ad.

For ad delivery, performance measurement, analytics and fraud prevention, Google may process the following. See Google’s iOS SDK data disclosure and Google’s privacy policy.

• IP address and approximate location inferred from it.
• Device/app information and applicable app- or developer-scoped device identifiers. IDFA is not requested or used.
• Ad/product interactions, such as ads viewed, app launches, taps and video viewing.
• Crash and performance diagnostics, including crashes, launch time, hangs and energy use. Performance information may be linked to the user and used for diagnostics, analytics and advertising.

The iOS app does not request ATT tracking permission or IDFA. Ad requests are set to non-personalised ads (npa=1); publisher first-party identifiers and publisher privacy-personalisation features are disabled. It does not use personalised ads or cross-app tracking that links activity in other apps/websites. This does not mean that no device, interaction or diagnostic information is processed.

When the ad button is pressed, our own server creates a reward-request identifier and checks the account’s reward eligibility. This own-server processing may occur before consent to provide information to Google. After consent, the identifier is passed to Google’s server-to-server reward verification. Our server links it with the account, ad transaction ID, completion time and reward records to verify rewards and prevent duplicates.

Withdrawing consent: use My Account → Ad privacy settings → Withdraw ad consent. No new rewarded ad is requested until you consent again. Withdrawal does not automatically delete information already sent to Google; its retention/deletion follows Google’s policy and the account/game-data rules here. Where regional Google privacy choices are required, you can reopen them in the same settings. These English menu names describe the existing functions; exact wording depends on the app version.

7. Toss mini app

The following applies to Toss game accounts, purchase-account linking, payments and ads. Actual features/products are shown in the app. Public release does not establish that all live purchase/ad-reward tests are complete. Android Google sign-in and ONEstore payment rules apply to their own versions, not automatically to Toss.

At game start, the server validates Toss’s game identifier (HASH) and stores its SHA-256 hash instead of the original value to distinguish the game account. Purchases, restoration or purchase-account linking separately use Toss sign-in and connect the BEATWAVE-specific userKey to the purchase account. Both identifiers are linked to records and are treated as personal information. They are not shared with other apps or automatically merged with Google/ONEstore accounts.

Information received from Toss

• The hashed game identifier and userKey link game/purchase accounts, mailbox items, progress and entitlements. They are retained while the account service is used and deleted without delay after withdrawal or the purpose ends.
• Agreed-terms information is checked in the Toss sign-in response. It does not include separate marketing consent.
• An encrypted name may arrive according to the mandatory name-sharing item in the Toss sign-in consent screen. The game does not use or decrypt the name or store it in a database/log; it is discarded after the response is processed. We therefore do not say that no name is ever received.
• The configuration does not request additional permissions for telephone number, date of birth, CI, email, gender or nationality. An email address and content you send in an enquiry are used to answer that enquiry.

Account-linked records include settings, progress, scores, play-credit balances/use, mailbox grants/claims and entitlements. Product/order identifiers and purchase/cancellation/refund status support delivery, recovery and duplicate prevention. The game server does not directly receive/store card or bank-account numbers.

For Toss rewarded ads, completion information from the Toss SDK, account-specific reward-request identifiers and grant records are used for reward handling and duplicate prevention. This differs from Google AdMob’s signed server-to-server verification. Toss’s handling follows Toss’s privacy policy.

Supabase stores and operates account records. Game identifiers and our own login sessions are stored as hashes; authentication keys and session tokens are not exposed in public pages or game screens. See the provider and international-transfer rules below. This notice does not replace any separately required transfer notice or consent.

Refusal, unlinking and deletion

You can refuse processing required to link a Toss purchase account. Refusing or unlinking makes that purchase-account connection, purchases and restoration unavailable, but basic play on the existing game account remains available. Separate marketing consent is not bundled with the required consent.

To unlink, open Toss → Settings → Authentication and security → Services signed in with Toss → BEATWAVE → Disconnect. Names may differ by Toss version. An authenticated unlink/consent-withdrawal notice terminates the purchase account’s BEATWAVE sessions through the connected server flow. It does not automatically delete game records. End-to-end live-user validation of unlinking through session termination is not yet complete.

Request access, correction, deletion, suspension of processing or consent withdrawal at ysmilk01@gmail.com. Only minimum account-verification information is requested. Do not send a password or login token. We process only the relevant BEATWAVE records, not records of other apps.

8. Service providers

We do not sell user information. Providers are used within the scope needed to operate the service.

• Supabase: authentication and BEATWAVE account, ranking, progress, mailbox, entitlement, purchase, reward and deletion-request records.
• Google sign-in: optional authentication using the information specified for each platform. Google passwords are not provided to the game.
• Google Play Billing: Google Play purchases, subscriptions, verification and refunds. Payment-method information is handled by Google Play.
• ONEstore: in-app purchases, subscriptions, verification, restoration and refunds; payment-method information is handled by ONEstore.
• Apple: Apple sign-in and revocation, App Store purchases, subscriptions and refunds.
• Google AdMob / UMP: Android advertising and region-dependent consent/privacy choices; iOS optional rewarded ads under the above consent conditions from 1.0.1. Public iOS 1.0 build 39 does not perform ad processing.
• Toss (Viva Republica): the mini-app environment, its in-app payments and advertising.
• Web ranking server: anonymous identifiers, generated display names, play conditions, scores and rankings for the web playtest.

Website Google Analytics/AdSense processing is separate from the game. The Korean website policy describes it; this app-linked policy document does not execute those scripts.

9. International transfers

When Google sign-in, AdMob or Supabase is used, necessary information may be transmitted over the network and processed on service servers outside Korea. This notice or optional ad consent does not replace any separately required international-transfer notice/consent.

Google LLC and its processors: account identifiers/email are used for selected sign-in. AdMob uses IP addresses, interactions, diagnostics, device/account identifiers and available Android advertising IDs for ad delivery, measurement, analytics and fraud prevention; UMP manages applicable privacy choices. Data may be transmitted when login/ad requests occur to the United States or other countries where Google operates servers and retained under Google’s policy. See Google’s privacy policy/contact information.

Supabase Pte. Ltd. and cloud processors (privacy@supabase.com): BEATWAVE account, game, purchase and ad-reward records are used for authentication, storage and service delivery. Login, saving, ranking, mailbox, purchase or reward-verification requests transmit necessary data to the project’s configured server region. The retention/deletion rules below apply. The exact project server country is not specified in the existing policy. See Supabase’s privacy policy.

Toss: the hashed game identifier, purchase-account identifier and game/purchase/reward records are sent to Supabase under those purposes and retention rules. Refusing purchase-account linking does not stop the separate server storage needed for basic play. If you do not want that processing, stop using the Toss version and request deletion of existing records.

iOS: necessary Google/Supabase information may also be processed abroad. Google rewarded-ad processing follows the 1.0.1 optional-consent rules and does not use IDFA. You may refuse or withdraw ad consent in My Account → Ad privacy settings while continuing basic play and purchases. Separately chosen sign-in, purchase and cloud-storage features follow their own rules.

Under the existing Android guidance, if you do not want overseas processing you may decline Google sign-in or stop using the Android app. Features requiring that processing—account/cloud saving, rankings, purchase restoration or ad rewards—may then be unavailable.

10. Retention and deletion

Account-linked game, credit, mailbox, entitlement and score records are retained as needed to provide the service and deleted without delay when the purpose ends or a deletion request is processed. Toss records follow the same purpose-based deletion rule. Where an actual transaction or dispute creates a statutory obligation, contract/withdrawal and payment/supply records are kept separately for five years, and consumer complaint/dispute records for three years, then destroyed. These periods do not apply to every game record. The basis is Article 6 of the Enforcement Decree of the Korean Act on Consumer Protection in Electronic Commerce, etc.

Logging out or uninstalling does not delete server records. Android/existing-platform requests are manually handled by email after identity and scope checks. Send the subject “BEATWAVE account deletion request” and the game-linked email to ysmilk01@gmail.com. Do not send passwords, OTPs, tokens or payment-card details. We do not delete your Google account itself, shared Google/Supabase authentication accounts used by other games, or other games’ records. We explain separately retained legal records and the result. Cancel store subscriptions separately.

On iOS, including guest accounts, use My Account → Delete BEATWAVE Account. No extra email or phone call is required. The operating standard is manual processing within seven days of receipt, not immediate automatic deletion. A linked email receives completion notice; guests without email can check the request number and status in My Account. See the translated deletion guide for the scope, request status, subscriptions and Apple sign-in revocation.

11. Children under 14

The service is not directed at children under 14, and we do not intentionally collect their information. This retains the age statement in the existing Korean policy; translation does not change it.

12. Contact and policy dates

Privacy enquiries and deletion requests: ysmilk01@gmail.com. Toss mini-app users may also use the enquiry function in the app. Ask for access, correction, deletion, suspension of processing or withdrawal of consent where applicable; the minimum information necessary to identify the relevant account may be requested.

Registered business: NINE TO SIX LAB (나인투식스랩). Registered representative, in the original Korean spelling: 김정민. Business registration number: 561-23-02332. Mail-order business registration: 2026-충남아산-0905. Representative phone: 010-8006-3985 (Korea).

Korean policy revised: 3 October 2026. Existing effective date: 24 September 2026; preceding policy effective date: 20 September 2026. The 3 October changes distinguish public versions, iOS guest server accounts/deletion, Toss game and purchase identities, and the optional-ad rules from iOS 1.0.1. Earlier changes on 25, 26 and 28 September covered account data, review/support accounts, payments, deletion requests and restructuring. The full dated history remains in the Korean source.

Translation published: 3 October 2026. International app releases are still being prepared. This translation does not introduce a new collection purpose, declare consent obtained or confirm overseas release.