Privacy Policy

Last updated: June 11, 2026 · Effective date: June 11, 2026

WorldCrown48 ("WC48", "we", "the Service") treats user personal data with care and complies with the EU General Data Protection Regulation (GDPR), Korea's Personal Information Protection Act (PIPA) and the Network Act, the UK Data Protection Act, the U.S. COPPA, and other applicable laws.

This Policy explains what personal data WC48 collects, the purposes of collection and use, retention periods, third-party sharing and international transfers, and your rights as a user.

⚠️ Legal review in progress: This Policy was drafted based on standard best practices and may be updated after prior notice in line with legal review and future changes in law.

1.1 Information you provide directly

1.2 Information collected automatically

1.3 Information from third-party authentication

When using social login (Google, Apple, etc.), we receive the following from the provider:

• Email address (required)
• Profile picture (optional, if you allow)
• Unique identifier (uid)

We do not receive your password, contacts, friend list, or social media activity history.

WC48 collects and uses personal data for the following purposes.

Analytics and marketing apply only when you have consented in the Cookie Policy.

• Account information: Deleted within 30 days of account closure (data subject to legal retention is stored separately for the required period)
• Voting history: Anonymized and stored permanently for analytics and service operation (no individual identification possible)
• Access · security logs: 14 months (Korea Protection of Communications Secrets Act)
• Reports · complaints: 5 years (E-Commerce Act + dispute response)
• Cookie consent records: 12 months (GDPR best practice)

WC48 does not share personal data with third parties except in the following cases.

1. When the user has consented in advance
2. When required by law or by a legitimate request from law enforcement
3. When processed in a form that cannot identify individuals, for statistical or research purposes

To run the Service reliably, WC48 uses the following processors. Some data may be transferred outside Korea.

You may object to international transfers, but doing so may limit access to core features (login, voting, etc.).

Regardless of where you reside (EU, UK, Korea, etc.), you may exercise the following rights.

WC48 responds to rights requests within 30 days.

• The minimum age to sign up for WC48 is 14 years (Korea Network Act + U.S. COPPA standard)
• If we learn that a user under 14 has signed up, the account and related data are deleted immediately
• Parents or guardians who wish to inquire about or delete their child's data should contact policy@
• Content involving minors is handled in line with Community Guidelines §2.2

WC48 implements the following technical and organizational measures to protect personal data.

• Transport encryption: All communication is encrypted with TLS 1.3 or higher
• Storage encryption: Passwords use bcrypt hashes; IPs use SHA-256 hashes
• Access control: Firebase Security Rules enforce per-user access permissions
• Principle of least privilege: Operators access only the minimum data needed for their work
• Backups: Firebase automated backups; the same security standards apply to backup data

In the event of a personal data breach, WC48 follows the procedure below.

• Upon detection: Scope and cause identification; further damage contained
• Within 72 hours: Notification to affected users via email (GDPR Art. 33·34)
• Within 72 hours: Notification to the relevant supervisory authorities (EU DPA, Korea KISA · PIPC)
• Post-incident: Root-cause analysis and prevention measures published in the announcements section

WC48 may perform the following automated processing.

• Tournament recommendations: Exposure of Tournaments based on user preferred categories (only with marketing-cookie consent)
• AI-Report: AI-generated content analyzing Tournament results (Footer-Only Lock per Design System v2.4)
• Abuse detection: Automatic detection of multi-account and bot patterns

You may request to be excluded from automated decision-making, though some features may then be limited.

For details on cookie use, please refer to the Cookie Policy. You may change your cookie consent at any time through the "Reopen cookie preferences" link at the bottom of any page.

EU residents may file complaints directly with their national data protection authority (DPA). Korean residents may file complaints with the Personal Information Protection Commission (privacy.go.kr) or the Korea Internet & Security Agency (privacy.kisa.or.kr).

This Policy may be updated due to changes in law, service expansion, or new processors.

• Material changes: announced at least 30 days before the effective date
• Minor changes: reflected by updating the "Last updated" date at the top of this page
• Channels: in-service announcements, email, and re-display of the consent modal

This policy may be updated after prior notice in response to legal or service changes. © 2026 WorldCrown48 · Privacy Policy v1.0