Privacy policy

Article 1 (Purposes of Processing Personal Information)

1. Linking Steam accounts, identifying users, saving and restoring game progress, and providing online services
2. Providing AI conversation and voice features, character settings and autocomplete, conversation context, memories, affinity, emotions, story branches, and destiny content
3. Storing, publicly sharing, managing, and handling reports concerning UGC selected by users
4. Granting, deducting, and managing balances of in-game currency, and confirming purchases and refunds, in versions where these features are available
5. Handling customer inquiries, rights requests, and disputes; preventing misuse; and responding to security incidents and service failures
6. Analyzing usage statistics and errors and improving game quality
7. Developing, training, fine-tuning, and evaluating the Company’s AI models; improving conversation quality and safety; and researching related AI technologies, subject to the legal basis and conditions in Article 7
8. Complying with legal obligations applicable to the Company, including retention of transaction records

If a purpose changes, the Company will take measures required by applicable law, including obtaining separate consent where required. Processing needed to generate game responses and maintain conversation memories is distinguished from model training for multiple users.

Article 2 (Items Processed, Collection Methods, and Legal Bases)

Optional features in the following table are processed only when a user selects the relevant feature. Processing necessary to perform a contract is based on Article 15(1)4 of the Personal Information Protection Act; consent-based processing on Article 15(1)1; and legal obligations on Article 15(1)2. Processing based on legitimate interests, such as preventing misuse, is limited to cases that satisfy the requirements of necessity, relevance, and balancing of interests under Article 15(1)6. Article 15 below also applies to users outside Korea.

[Confirmation required: Whether additional information is actually received from Steam (such as profile name, image URL, or country); the actual inputs for the destiny feature, such as date and time of birth; whether UGC image uploads are supported; and the precise data transmitted by the analytics SDK. Do not add items that are not collected.]

Character settings may include fictional settings entered by a user, such as personality, occupation, MBTI, appearance, height, blood type, date of birth, nationality, interests, ideal type, background, fictional universe, and values. Settings needed for autocomplete or facial-description generation are sent to AI providers. This does not mean that users are required to provide their own corresponding information. Personally identifiable input is protected as personal information even if entered in a fictional settings field.

The Company does not require a real name, resident registration number, address, or telephone number to use the game. Payment-method information is processed by Valve, and the Company does not receive card or bank account numbers. Because free-text fields and inquiries may contain such information, please do not enter unnecessary personal information or another person’s personal information.

The Company does not require users to enter sensitive information. Even if a user includes sensitive information, such as health, sex life, or beliefs, in a conversation, the input itself is not considered separate consent. The Company will not include such information in research or training without a lawful basis, and will restrict its use and disclosure and take steps such as deletion if unnecessary information is identified. For a feature that requires processing sensitive information, the Company will first secure a statutory basis, such as separate consent.

Article 3 (Retention Periods)

The Company destroys personal information without delay when a reason for destruction arises, including achievement of the purpose, withdrawal of consent, or a lawful deletion request. Where a separate statutory retention obligation applies, only the applicable records are segregated and retained. The maximum retention period for Conversation Data used for training is set out below and is distinct from the retention period for original conversations used to provide the game.

The retention periods for electronic-commerce records are based on Article 6 of the Act on the Consumer Protection in Electronic Commerce, etc. and Article 6 of its Enforcement Decree. The Company does not retain entire conversations for an extended period as transaction records when they are not subject to statutory retention.

Article 4 (Provision to Third Parties)

The Company provides personal information to third parties only to the extent necessary when separate consent or a legal basis permits it. The Company also verifies the legal basis and lawful procedure for requests from investigative authorities. Transfers to processors for entrusted work are described separately in Article 5, and overseas transfers in Article 6.

Valve is an independent platform operator that processes Steam account, purchase, and payment information for its own purposes and under its own policies. Information that the Company sends to Valve is distinguished from information received from Valve. The Company’s disclosures to Valve: [Confirmation required: Actual authentication, achievement, transaction, and Cloud data transmitted; purposes; retention periods; and basis under Article 17 of the Personal Information Protection Act. Information the Company does not send must not be listed as disclosed.]

The Company does not sell private conversations for advertising or disclose them to other users. Public UGC is governed by Article 8. This Policy does not grant blanket permission for external vendors to use user conversations to train their own general-purpose models.

Article 5 (Entrustment of Processing)

The Company engages processors to process personal information needed for the work below and reflects and manages applicable statutory requirements in its contracts, including prohibitions on processing outside the purpose, safeguards, subprocessors, deletion, and oversight.

Vendor-specific retention and transfer details should be read together with Article 6. Additional processors and subprocessors for customer-support email, error tracking, AI routing, and similar services: [Confirmation required: Actual use and matters requiring disclosure]. If training is newly entrusted to a processor, the Company will first confirm and disclose the processor, work, transferred items, and transfer basis. Changes to entrusted processing will be reflected in accordance with statutory notice and consent requirements.

Article 6 (Overseas Transfers)

Where personal information is provided, entrusted, stored, or accessed overseas, the Company gives notice as follows. The Company does not assume that an entity’s place of establishment and the countries where data is actually processed or stored are the same. The public notice is incomplete until the unconfirmed items in the following table are confirmed.

For overseas entrustment or storage necessary to perform a contract, the Company relies on Article 28-8(1)3 of the Personal Information Protection Act where its requirements are satisfied; for transfers requiring separate consent, the Company obtains consent under Article 28-8(1)1. The legal basis for third-party disclosure and the legal basis for overseas transfer must each be satisfied. This explanation alone does not authorize every transfer; the basis actually applied will be confirmed and stated in the table.

Requests to exercise transfer-related rights, refuse a transfer, or withdraw consent may be submitted to hello@tridot.io. Refusing transfers related to optional analytics or training does not disadvantage basic game use. If a transfer required for an essential AI-response or voice-processing function stops, only the function that depends on that processing may be restricted, and the scope of the restriction will be explained. For account and payment information processed independently by Steam, users may also use Steam’s rights-request procedures.

Article 7 (AI Conversations and Model Training)

7.1 Processing to Provide the Service

The Company uses inputs and responses, together with necessary character settings, conversation context, summaries, and memories, to generate responses and maintain game progress. If a voice feature is selected, the Company converts voice to text and synthesizes responses as speech. This processing is distinct from consent to model training described below, and processing necessary for selected game features may continue even if training is refused.

7.2 Optional Consent for Conversation Data and Purposes of Use

At the game’s first launch, the Company may obtain separate, optional consent—distinct from use of the basic game—to use Conversation Data for developing, training, fine-tuning, and evaluating the Company’s AI models and for improving AI-based service models and performance. This includes improving the conversational quality, context comprehension, character consistency, response accuracy, and safety of conversational AI developed and operated by the Company. Any new use outside the disclosed purposes will first follow lawful procedures, including any required notice and consent.

The data concerned is Conversation Data exchanged between a user and AI characters and stored as text, and it applies only to conversations generated after consent. To include earlier conversations, the Company will separately disclose the period and scope and obtain consent. Payment, download, or game use itself is not considered consent to training. Original audio, photographs, and videos are not used for training. Whether text converted from voice and stored is included will be stated clearly on the actual consent screen. [Confirmation required: Whether stored speech-to-text transcripts are included in training]

Refusal does not disadvantage basic game progress or use of purchased content. The Company manages records of the consent decision, time, wording version, and withdrawal, and will not begin training based on this consent until a lawful consent procedure is implemented. [Confirmation required: Implementation of the optional consent screen at first launch and storage of consent records]

7.3 Database Storage and Anonymization Before Training

Conversation Data is stored in the Company’s database for the service purposes in Articles 1 and 2, including response generation and maintenance of game progress and memories. The entire set of original records stored in the database is not anonymous information. The protections and retention and destruction standards in Article 3 apply to original Conversation Data. Conversations of users who do not consent to training may still be stored as necessary to provide the game, but are not incorporated into training under that optional consent.

The Company selects Conversation Data within the scope of training consent and anonymizes it so individuals cannot be identified before it is used in actual model training. The Company considers not only account identifiers but also identifying information within conversation content and context and the possibility of linking the data to the original or account. Merely deleting or replacing an ID is not considered sufficient anonymization. Sensitive information and identifiers of other individuals are excluded or removed during selection, and material for which appropriate anonymization cannot be ensured is not used for model training.

Whether information is anonymous is determined under applicable-law standards, including the possibility of combination with other information and the time, cost, and technology reasonably expected to be used. Optional consent, any other necessary lawful basis, and safeguards also apply during selection and processing before anonymization. This Policy does not create a loophole permitting Conversation Data to be trained as pseudonymized research data without separate consent. [Confirmation required: Actual anonymization procedure, removal of linkage information, adequacy review, and access controls]

Conversation Data for training and anonymized copies are retained for no more than 3 years under Article 3. This period does not automatically extend the retention period for original conversations used to provide the game.

7.4 Refusing or Withdrawing Training Consent and Deletion

Training consent may be withdrawn at hello@tridot.io. In-game withdrawal path: [Confirmation required: Actual menu path]. Once a withdrawal request is confirmed, the Company stops selecting and incorporating new conversations for training and immediately excludes from training any already selected Conversation Data and training copies that remain linkable to the user. Exclusion from training means that the material will not be used for training; deletion is a separate obligation to destroy that material while it is retained. Excluding material from training does not replace the obligation to delete it. Linkable training copies are deleted without delay absent a separate lawful basis for retention. Any minimum information that must be retained under a separate legal basis is segregated, not used for training, and accompanied by notice of the items, basis, and period. Deletion of original conversations used to provide the game may be requested separately under Article 7.8.

Conversation Data already lawfully anonymized so that the user can no longer be identified and the data cannot be linked to the account or original may be difficult to locate and delete for a particular user. The maximum retention period in Article 3 still applies to such data. This does not eliminate the obligation to delete linkable copies before anonymization.

It may be difficult to remove the effect of a particular sentence individually from a completed model, but this does not categorically exclude legal rights concerning personal information that remains in or is reproduced by a model. The Company takes measures required by applicable law and explains the processing result and reasons for any limitation.

7.5 Training by External AI Providers

Consent to the Company’s own training is not consent to independent training of an external AI provider’s general-purpose models. The Company separately discloses vendor training use, safety logs, and retention. [Confirmation required: Actual training use, contracts, settings, and exceptions for each account listed in Article 5]. No training use does not necessarily mean no retention. Training performed by a processor under the Company’s instructions will begin only after the requirements of Articles 5 and 6 and a lawful basis are in place.

7.6 Review by Authorized Personnel

Authorized personnel may review content to the extent necessary to handle inquiries, reports, service failures, and security issues and to lawfully select, anonymize, annotate, and evaluate Conversation Data. The scope, choices, and safeguards in Articles 7.2–7.4 also apply to human review for training. Access is limited to the minimum personnel and scope required for the work.

7.7 AI Outputs and Automated Decisions

Characters are AI, not real people, and responses may contain errors. Responses and destiny content are not professional medical, legal, or financial advice. Affinity, emotion, and story branching based on conversation analysis are processing for game progress. Rights to an explanation or review of automated decisions may be exercised in accordance with the requirements and scope of applicable law, without limiting any statutory right to refuse decisions that materially affect a person’s rights or obligations. If separate automated decisions concerning account sanctions, payments, or other matters are used, the Company will separately explain the processing and how to exercise rights.

7.8 Deleting Conversations

Users may request deletion of conversations for an individual character or all conversations at hello@tridot.io. Related summaries, memories, and relationship state will also be processed within the requested scope. Because deletion may make it impossible to restore related game progress, the Company will explain the effects. If an in-game deletion menu is available, users may also use it. Deletion from Company systems and deletion of Steam Cloud copies are distinguished under Article 10.

Article 8 (Public Sharing of UGC)

Settings, content, display names, and related information publicly shared through the UGC sharing feature can be viewed by other users. The visibility scope and displayed items are explained before posting. Do not post personal information or another person’s photograph or contact information. Use of the UGC public-sharing feature does not make private conversations public when the user has not chosen to publish them.

The Company uses identifiers of the reporting and reported accounts and related content only to the extent necessary to handle reports. Infringement reports may be submitted to hello@tridot.io. Upon a deletion request, the Company deletes or blocks public copies it controls, but it may be difficult to retrieve copies already downloaded by other users. The Company’s statutory obligations to protect users and respond are not waived.

Article 9 (Steam Payments and Refunds)

When purchasing features are available, Valve directly processes payment methods, and the Company processes information under Article 2 needed to confirm transactions and manage currency. Refunds for the base game are governed by the Steam Refund Policy and applicable law. Prices, use, and refund conditions for in-game currency are available in the purchase notice and Terms of Use presented before purchase. Processing of purchase information does not apply to a demo without purchasing features.

Steam may provide refund statistics and user-entered reasons in developer refund reports. If the Company views or uses them, use is limited to what is necessary for service improvement and inquiry handling; viewing a report is not treated as automated per-account API collection for all users. [Confirmation required: Whether the Company actually views or exports reports and the retention period for reasons containing personal information]

Article 10 (Destruction and Platform Copies)

The Company destroys personal information without delay when it is no longer necessary. Information retained by law is segregated from other information and used only for that purpose. Electronic information is deleted using methods that prevent recovery or reproduction, and paper records are shredded or incinerated.

Deletion is reflected, as appropriate to its scope, in operational databases; related summaries, memories, and search-derived data; training copies; and personal information transferred to processors. Backup destruction and replacement cycle and restrictions on use: [Confirmation required: Actual maximum period and procedure]. If a backup is restored, information subject to deletion is prevented from returning to service use.

When the Company confirms that a Steam account has been deleted, it also processes related information it holds, except information subject to statutory retention. In versions supporting Steam Cloud, users may disable synchronization in Steam settings, but disabling it alone does not delete existing copies. A deletion request to the Company applies to the scope it can control; for information independently held by Valve, users must also follow the procedures in the Steam Privacy Policy. [Confirmation required: Actual Cloud support, stored files, and deletion linkage]

Article 11 (Exercising Rights)

Users and lawful representatives may contact hello@tridot.io to exercise rights of access, correction, deletion, suspension of processing, withdrawal of consent, portability under applicable law, and rights relating to automated decisions. The Company may request the minimum information necessary to verify account ownership or authority to act. It does not request an unnecessary full identity document or resident registration number.

The Company takes action within the statutory period and, where a limitation, refusal, or lawful extension is necessary, explains the reason and next steps. Rights may be limited to the extent permitted by applicable law for information subject to statutory retention and similar cases. See Article 7 for training choices and deletion and Article 6 for overseas transfers.

Article 12 (Children and Adolescents)

Minimum age for the service and AI features: [Confirmation required: Actual operational standard and conditions under AI-provider products and contracts]. Where the Company processes personal information of a child based on consent and the consent of a legal guardian is required, it will first implement the required consent and verification procedures. If the Company identifies a child’s personal information collected without a lawful basis, it takes necessary measures such as deletion.

For consent-based processing of users outside Korea where legal-guardian consent is required, the standards and procedures of the relevant region apply. The EEA follows each country’s standard, and the United Kingdom follows the applicable consent rules for online services. Game ratings, the age at which a person can consent to personal-information processing, and the minimum age for external AI services may differ. A legal guardian may exercise rights under Article 16.

Article 13 (Safeguards)

The Company implements technical and organizational measures under applicable law, including internal management, personnel training, minimum access privileges, access-log management, encryption, and security software, and manages safeguards including physical controls at cloud facilities. The selection, anonymization, segregated storage, and access restrictions in Article 7 apply to Conversation Data used for training. The Company complies with applicable notification and reporting requirements and deadlines in the event of a breach.

Article 14 (Analytics, Cookies, and Choices)

Before sending optional analytics through GameAnalytics, the Company explains the purposes, items, recipients, and retention period and obtains separate consent. Refusal or withdrawal does not disadvantage basic game use, and optional analytics are distinguished from essential security and game-operation records. Refusal and withdrawal path: [Confirmation required: Actual in-game path] and hello@tridot.io. Implementation must stop transmission before consent and stop new transmission after withdrawal.

Items actually collected: [Confirmation required: Confirmed list by SDK version, Windows settings, analytics ID, IP address, events, device, and error information]. The service is designed not to send the original content of private conversations to optional game-usage analytics, and actual event content must follow that design. Whether advertising identifiers or cross-service tracking are used will be stated based on verified facts.

Game network logs and SDK identifiers differ from web cookies. If the official website or an in-game webview uses cookies or external tools, that page will explain the items, purposes, periods, and refusal methods and obtain required consent. Blocking browser cookies does not automatically stop transmission by the game SDK. [Confirmation required: Actual status of webview and website cookies].

Article 15 (Regional Rights)

15.1 EEA and United Kingdom

Where the relevant law applies, necessary service provision is based on performance of a contract; optional training and analytics on consent; security and misuse response on legitimate interests following a balancing test; and obligations under that law on legal obligations. Korean retention obligations are not automatically treated as obligations under EU or UK law. Pseudonymization alone does not remove the requirements for consent or another lawful basis.

Users may exercise statutory rights to access, correction, deletion, restriction, portability, objection, withdrawal of consent, and rights relating to automated decisions, and may lodge a complaint with the competent supervisory authority. Withdrawal of consent does not affect the lawfulness of processing before withdrawal. The Company generally responds to GDPR requests within one month and explains the reason for any lawful extension.

The EU adequacy decision for Korea may apply to transfers from the EEA to Korea within its scope. The Company separately reviews lawful bases for transfers from the United Kingdom and onward transfers from Korea to third countries. [Confirmation required: Adequacy decision, SCCs, UK mechanisms, safeguards actually used, how to request copies, and the names, addresses, and contact details of any required EU and UK representatives].

15.2 California

To the extent the CCPA/CPRA applies to the Company and the processing, the Company provides rights to know and access collected information, delete, correct, opt out of sale or sharing for cross-context behavioral advertising, limit use of sensitive personal information as provided by law, and receive non-discriminatory treatment for exercising rights. [Confirmation required: Actual sale, sharing, and advertising practices. Private conversations are not sold for advertising under Article 4]. This information is provided together with the categories, sources, purposes, recipients, and retention periods described in this Policy.

15.3 Chinese-Language Users

The Chinese versions are language-specific notices; language selection or whether a Chinese game approval has been obtained does not by itself exclude the application of privacy law. The Company complies with mandatory laws and rights applicable based on service regions and actual processing. [Confirmation required: Additional notice, consent, and transfer requirements if the PIPL applies to users in mainland China].

15.4 Taiwan

The purposes of collection are set out in Article 1, and the categories, periods, regions, recipients, and methods are set out in Articles 2, 3, 5, and 6. Under the applicable Personal Data Protection Act, users may request inquiry or access, copies, supplementation or correction, and cessation of collection, processing or use, and deletion. If information necessary for an essential feature is not provided, that feature may be restricted; refusal of optional training or analytics does not affect basic game use.

Article 16 (Chief Privacy Officer and Contact Information)

• Chief Privacy Officer (CPO): 전경찬 / Kyungchan Jun / Chief Executive Officer
• Rights-request intake and handling: Operations Team
• Email: hello@tridot.io
• Company: Tridot Inc. (주식회사 트라이닷) / Representative: 전경찬 / Kyungchan Jun
• Address: 서울특별시 강남구 역삼로 217, 601호 (Room 601, 217 Yeoksam-ro, Gangnam-gu, Seoul, Republic of Korea)
• Business registration number: 372-81-01941 / Mail-order business registration number: 제2024-서울강남-06300호

The person above is the Chief Privacy Officer under Korean law; this designation does not imply appointment as an EU or UK representative or as a DPO under the GDPR. [Confirmation required: Current address, responsible department, and additional contact information]

Article 17 (Remedies for Infringement of Rights)

Users may contact the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118 within Korea), or the Korean National Police Agency Cybercrime Reporting System (ecrm.police.go.kr). Users outside Korea may also lodge a complaint with the competent data-protection supervisory authority in their place of residence.

Article 18 (Changes and Languages)

The planned publication and effective date of this Policy is September 14, 2026. It is currently a pre-publication review draft; reaching the planned date does not approve unconfirmed content or automatically put the Policy into effect. After confirming the final disclosures and operational readiness, the Company will show the actual publication and effective dates in the publicly released Policy. As a rule, ordinary changes are announced 7 days in advance and changes materially affecting user rights 30 days in advance. Any additional notice or consent required by applicable law is handled separately. Where prior notice is difficult due to legal compliance, an urgent security measure, or similar circumstances, the Company will explain the reason and change without delay. Continued use or viewing a notice is not considered consent to training.

The Korean, English, Simplified Chinese, and Traditional Chinese versions describe the same processing standards. Translation differences do not reduce users’ statutory rights, and confirmed discrepancies will be corrected. If a previously published version exists, it will remain available with its effective period.