Privacy Policy
김재희 (the "Operator"), who operates PUBG Insight (the "Service"), establishes and publishes this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act to protect data subjects' personal information and handle related complaints promptly and smoothly.
1. Purposes of processing personal information
The Operator processes personal information for the following purposes. If a purpose changes, the Operator takes the necessary measures under Article 18 of the Personal Information Protection Act.
- Member registration, identification, authentication, and management (email verification, password resets, social login connections, and two-factor authentication)
- Member features (favorite players, recent searches, default player, saved comparisons, and display settings)
- Account security and prevention of misuse (login attempt limits, blocking automated registrations and logins, session management, and security incident response)
- Essential Service notices (changes to the Terms or Privacy Policy and security notices), and handling inquiries and requests to exercise rights
- Providing searches and analysis of public match records available through the official PUBG API
The Operator does not process personal information for advertising or marketing, collect behavioral information for personalized advertising, or sell personal information.
2. Personal information processed, legal bases, and retention periods
| Category | Information | Legal basis | Retention period |
|---|---|---|---|
| Email registration (required) | Email, name (nickname), and password (stored using one-way encryption) | Entering into and performing a contract (Article 15(1)(4) of the Act) | Destroyed immediately upon account deletion |
| Google login (required) | Email, name, profile photo URL, Google account identifier, and authentication tokens (stored encrypted) | Entering into and performing a contract | Destroyed upon account deletion or disconnection |
| Discord login (required) | Email, username, avatar URL, Discord account identifier, and authentication tokens (stored encrypted) | Entering into and performing a contract | Destroyed upon account deletion or disconnection |
| Kakao login (required) | Kakao account email, Kakao member number, and authentication tokens (stored encrypted); nickname and profile photo URL if provided | Entering into and performing a contract | Destroyed upon account deletion or disconnection |
| Terms acceptance record (required) | Accepted Terms version, time of acceptance, and confirmation of being at least 14 years old | Entering into and performing a contract | Destroyed upon account deletion |
| Two-factor authentication (optional) | Authenticator app secret and backup codes (stored encrypted) | Performing a contract (when enabled by the user) | Destroyed when disabled or upon account deletion |
| Member features (optional) | PUBG platforms and account identifiers designated as favorite or default players, recently searched players (20 most recent), saved comparisons (up to 20, including titles and selected subjects), and display settings | Performing a contract (when used by the user) | Destroyed immediately when deleted by the user or upon account deletion |
| Information | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Login sessions (session identifier, connection IP address, browser information (User-Agent), and creation and expiration times) | Maintaining login, checking connected devices on the account page, and forcing logout | Performing a contract | Destroyed when the session expires 7 days after its last use, or upon logout or account deletion |
| Security records (results of login, registration, and password reset attempts, connection IP, browser information, and one-way hashes of email addresses) | Detecting brute-force attacks and misuse, and responding to incidents | Legitimate interests (Article 15(1)(6) of the Act) | 3 months |
| Request limit counters (connection IP and one-way hashes of email addresses) | Blocking excessive login and registration attempts | Legitimate interests | Automatically deleted within 1 hour |
| Web server access records (connection IP, request time and address, and response code) | Analyzing Service failures and security incidents | Legitimate interests | 3 months |
| Information | Source | Legal basis | Retention period |
|---|---|---|---|
| PUBG player nicknames, account identifiers and platforms; match records (placement, kills, damage, weapons used, movement routes, etc.); season and ranked statistics; and leaderboard positions | The official PUBG developer API operated by KRAFTON (public data) | Legitimate interests in processing publicly available information within the scope of its publication purpose (Article 15(1)(6) of the Act) | Retained while the Service is provided (to avoid requesting match records that have already been stored again). Requests by the data subject to suspend processing are handled without delay |
Required registration information is the minimum necessary to enter into and perform the Service agreement and is processed without separate consent. Optional information is processed only when the user uses the relevant feature.
3. Procedures and methods for destroying personal information
- Personal information is destroyed without delay (within 5 days at the latest) when its retention period ends or its processing purpose is achieved. Upon account deletion, member information and member feature data are deleted immediately in a single operation.
- Electronic files are deleted in a way that prevents recovery. Paper documents are not retained.
- Deleted information may remain for up to 5 weeks in database backups for disaster recovery (7 daily and 4 weekly backups, in private storage). It is destroyed as backups rotate and are deleted after that period. Backups are used only for recovery.
- No personal information must be retained under other laws (there are no paid transactions, so retention obligations under the Electronic Commerce Act do not arise).
4. Provision of personal information to third parties
The Operator does not provide data subjects' personal information to third parties. However, information may be provided within the scope permitted by law when the data subject consents or a specific legal provision applies (such as a lawful request from an investigative agency).
5. Outsourcing the processing of personal information
| Processor | Outsourced work | Storage location |
|---|---|---|
| Oracle Corporation (Oracle Cloud Infrastructure) | Operating Service servers and storing databases and backups | Chuncheon region, Republic of Korea (ap-chuncheon-1) |
Through outsourcing agreements (service terms), the Operator checks restrictions on processing beyond the outsourced purpose, security measures, and restrictions on further outsourcing. Any change in processors is disclosed without delay in this Policy.
6. Overseas transfers of personal information
To perform the Service agreement, the Operator outsources personal information processing overseas as described below. The legal basis is Article 28-8(1)(3)(a) of the Personal Information Protection Act (outsourced processing for entering into or performing a contract that is disclosed in the Privacy Policy).
| Recipient (contact) | Country | Information transferred | Transfer timing and method | Purpose | Retention and use period |
|---|---|---|---|---|---|
| Plus Five Five, Inc. (Resend) · support@resend.com | United States | Email address and email content (verification and reset links) | Sent over an encrypted network (HTTPS) when verification or password reset emails are sent | Sending email verification and password reset emails | Until sending is completed (including the processor's delivery log retention period); destroyed when the outsourcing agreement ends |
| Cloudflare, Inc. (Turnstile) · dpo@cloudflare.com | United States | Connection IP address and browser information (User-Agent and TLS characteristics) | Sent from the browser over an encrypted network when a security check is needed during login, registration, or password reset | Blocking automated registrations and logins (bots) | Until the security check is completed (according to the processor's policy) |
If you do not want overseas transfers, you can choose not to register or delete your account. You will then be unable to use member features that require email verification, password resets, or security checks, but you can continue using match record searches available without logging in.
7. Rights and obligations of data subjects and legal representatives, and how to exercise them
- Data subjects may request access, correction or deletion, suspension of processing, or withdrawal of consent at any time (Articles 35–37 of the Act).
- How to exercise rights: After logging in, use [My Account] to delete favorites, recent searches, or saved comparisons, disconnect logged-in devices or social accounts, and delete your account. Other requests can be sent to the privacy officer's email below. Exercising rights is made no more difficult than registering.
- Subjects of public PUBG match records (including non-members) may request suspension of processing or deletion of their own player information. Information that verifies ownership of the PUBG account may be requested to confirm identity.
- The Operator takes action and informs you of the result within 10 days of receiving a request. If a request is refused or restricted under law, the Operator also explains the reason and how to object. Objections may be sent to the same email address.
- Rights may also be exercised through a data subject's legal representative or an authorized agent. A power of attorney must be submitted in this case.
- Data subjects must keep their personal information and passwords secure and must not steal or infringe upon another person's information.
8. Personal information of children under 14
Only people aged 14 or older may register as members, and this age requirement is confirmed during registration. If the Operator learns that a child under 14 has registered, the account and personal information are destroyed without delay. A child's legal representative may request access to the child's personal information and exercise related rights (Article 38(2) of the Act).
9. Measures to safeguard personal information
The Operator takes the following measures under Article 29 of the Personal Information Protection Act and Article 30 of its Enforcement Decree.
- Administrative measures: The privacy officer directly oversees processing and keeps the number of administrator accounts with access to personal information to a minimum.
- Access control: Administrator features require two-factor authentication. Database and cache servers are isolated to prevent access from the public internet.
- Encryption: Passwords are stored using irreversible one-way encryption. Social login tokens and two-factor authentication secrets are stored encrypted, and all communication is encrypted with HTTPS.
- Blocking compromised passwords: Passwords are checked against known breaches during registration and password changes. The password itself is not sent; only the first 5 characters of its hash are used (Have I Been Pwned, k-anonymity).
- Responding to unauthorized access: Login attempts are limited, security checks are applied according to risk, and security records are retained and reviewed.
- Physical measures: Servers and backups are kept in the cloud provider's access-controlled facilities and private storage.
11. Processing that does not apply
- Sensitive information and unique identification information (such as resident registration numbers) are not processed.
- Pseudonymized information is not processed.
- Behavioral information is not collected or used for personalized advertising.
- Personal information is not additionally used or provided (Articles 15(3) and 17(4) of the Act).
- Fully automated systems are not used to make decisions that significantly affect data subjects (Article 37-2 of the Act).
12. Privacy officer
| Role | Name | Contact |
|---|---|---|
| Privacy officer (Operator) | 김재희 | gogoomandoo1@gmail.com |
Please use the contact details above for inquiries, complaints, or requests for remedies related to personal information processing. The Operator responds and handles them without delay.
13. Remedies for infringements of rights
You may contact the following organizations to report a personal information infringement or seek advice.
- Personal Information Infringement Report Center (Korea Internet & Security Agency)118 (no area code)
- Personal Information Dispute Mediation Committee1833-6972
- Supreme Prosecutors' Office, Cyber Investigation Division1301 (no area code)
- National Police Agency, Cyber Investigation Bureau182 (no area code)
14. Changes to the Privacy Policy
- This Privacy Policy applies from October 1, 2026.
- Changes and their effective date are announced on the Service and this page at least 7 days before they take effect. Changes significantly affecting data subjects' rights, such as additional collection or overseas transfers, are announced at least 30 days in advance.
- Previous policies are available in the revision history at the bottom of this page.
Change History
- October 1, 2026 effective — initial publication (version 2026-10-01)