Privacy Policy

Data Controller

morpi ("we," "us," or "our") operates the TextFight service at textfight.io. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website or use our game.

Data Controller: morpi, --201, -, 9 Daecheongbuk-gil 17beon-gil, Jung-gu, Busan, 48969, Republic of Korea. Chief Privacy Officer (CPO) contact: textfight99@gmail.com.

By accessing or using TextFight, you consent to the collection and use of information in accordance with this policy. If you do not agree, please do not access or use TextFight.

IMPORTANT: This document is provided for informational purposes and has not been reviewed by legal counsel. We recommend consulting a qualified attorney for jurisdiction-specific legal advice.

Categories of Personal Information Collected

Account Information

We collect personal information when you create an account and use our service. The categories of data we collect are:

• Email address and display name (via Google OAuth sign-in)
• Username you choose during registration
• Hashed password or OAuth provider token
• User ID (UUID) and session tokens (JWT stored in secure httpOnly cookies)
• Anonymous session identifiers for guest accounts
• Last sign-in timestamp and IP address at authentication time

Gameplay Data: Fighter names and descriptions (up to 300 characters), fighter traits and evolution data, battle history and AI-generated battle narratives, ELO ratings and win/loss records, leaderboard rankings, in-game currency (coin) balances, and transaction history.

Payment Data: When you make a purchase, payment information (credit card details, billing address) is collected and processed directly by Xsolla, our payment partner. We do not store your payment card details on our servers. We receive from Xsolla: transaction IDs, purchase amounts, subscription status, and payment confirmation data.

Technical Data: IP addresses, browser type and version (User-Agent), device type and operating system, referring URLs, pages visited and time spent, and server request logs (collected by our hosting provider, Render.com).

Sources of Personal Information

We collect personal information from the following sources:

• Directly from you — when you register, create fighters, initiate battles, or make purchases
• From Google OAuth — basic profile information (email and display name) when you sign in with Google
• Automatically — technical data collected through cookies, server logs, and similar technologies when you use the service
• From Xsolla — payment confirmation and transaction data when you make purchases

Purpose of Collection and Processing

We use the information we collect for the following purposes:

• Service delivery — provide, maintain, and improve the TextFight game experience
• Battle processing — generate AI battle narratives using your fighter data
• Ranking — calculate and update ELO ratings and leaderboard positions
• Account management — manage your account, fighters, and in-game progress
• Payments — process purchases and manage subscriptions via Xsolla
• Communication — send service-related messages (account verification, important updates)
• Advertising — display relevant advertisements through Google AdSense
• Security — detect and prevent fraud, abuse, cheating, and unauthorized access
• Legal compliance — fulfill legal obligations under applicable law
• Analytics — understand how players use the service to improve it

Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we process personal data under the following legal bases:

• Contract performance — processing necessary to provide the TextFight service you signed up for (account management, gameplay, battle processing)
• Consent — where you have given explicit consent (e.g., marketing communications, personalized advertising via Google AdSense cookies)
• Legitimate interests — processing necessary for our legitimate business interests (fraud prevention, service improvement, analytics), balanced against your rights
• Legal obligation — processing necessary to comply with applicable laws (tax records, law enforcement requests)

Data Retention

We retain your personal data for as long as necessary to fulfill the purposes described in this policy:

• Active accounts — data retained for the duration of your account's existence
• Guest accounts — automatically deleted after 24 hours of inactivity, along with all associated data (fighters, battles, progress)
• Deleted accounts — personal data removed within 30 days of account deletion. Some anonymized game data (aggregate battle statistics) may be retained indefinitely for analytics
• Payment records — transaction data retained for 5 years as required by Korean tax law
• Server logs — retained for up to 90 days for security and debugging purposes
• Xsolla webhook audit logs — retained for 1 year for payment dispute resolution

Destruction of Personal Information

When personal information is no longer needed or the retention period has expired, we destroy it without delay using the following methods:

• Electronic files — permanently deleted using secure deletion methods that render the data unrecoverable
• Database records — purged from all primary databases and replicas within the retention timeline
• Backup systems — removed from backup storage within 90 days of deletion from primary systems

Third-Party Services (Data Sharing)

We do not sell your personal information. We share data with the following third-party service providers as necessary to operate TextFight:

• Supabase (Supabase Inc., USA) — provides authentication, database hosting, and backend infrastructure. Supabase processes your account data, gameplay data, and session tokens on our behalf. Privacy policy: supabase.com/privacy
• OpenAI (OpenAI, LLC, USA) — powers AI battle narrative generation. Fighter names, descriptions, traits, and battle context are sent to OpenAI's API for processing. We do not send personally identifiable information (email, real name) to OpenAI. Under OpenAI's API terms, data sent via the API is not used for model training by default
• Google Gemini (Google LLC, USA) — alternative AI provider for battle narrative generation. Same data processing scope as OpenAI
• Xsolla (Xsolla Inc., USA) — processes all payments for in-game purchases and subscriptions. Xsolla collects payment card details, billing information, and IP address directly. We do not store your payment card details. Privacy policy: xsolla.com/privacypolicy
• Google AdSense (Google LLC, USA) — serves advertisements on our website. Google may use cookies to serve ads based on your prior visits to TextFight or other websites. You can opt out of personalized advertising at Google Ad Settings (adssettings.google.com)
• Google OAuth (Google LLC, USA) — handles sign-in authentication. We receive only basic profile information (email and display name)
• Render.com (Render Inc., USA) — hosts the TextFight application. Render processes server request logs including IP addresses

Entrustment of Data Processing

Under the Korean Personal Information Protection Act (PIPA), we have entrusted the processing of personal information to the following entities:

• Supabase Inc. — entrusted tasks: user authentication, database hosting, data storage and retrieval. Contact: privacy@supabase.io
• Xsolla Inc. — entrusted tasks: payment processing, subscription management, transaction record keeping. Contact: privacy@xsolla.com
• Render Inc. — entrusted tasks: application hosting, server-side processing, request logging. Contact: privacy@render.com

We supervise our data processing partners to ensure they handle personal information securely and in accordance with applicable law. Entrustment agreements require partners to process personal information only for the entrusted purposes and to implement appropriate security measures.

International Data Transfers

TextFight is operated from the Republic of Korea. Your personal information may be transferred to and processed in countries outside your country of residence, including the United States, where our service providers (Supabase, OpenAI, Xsolla, Google, Render) are located.

Details of overseas transfers:

• Recipient: Supabase Inc. (USA) — Items transferred: account data, gameplay data, session tokens — Purpose: authentication and database services — Retention: duration of service agreement
• Recipient: OpenAI, LLC (USA) — Items transferred: fighter names, descriptions, traits, battle context — Purpose: AI battle narrative generation — Retention: not retained by OpenAI under API terms (zero data retention policy)
• Recipient: Xsolla Inc. (USA) — Items transferred: user ID, purchase data, IP address — Purpose: payment processing — Retention: per Xsolla's retention policy
• Recipient: Google LLC (USA) — Items transferred: email, display name (OAuth); browsing data (AdSense) — Purpose: authentication and advertising — Retention: per Google's retention policy
• Recipient: Render Inc. (USA) — Items transferred: IP addresses, request logs — Purpose: application hosting — Retention: up to 90 days

For transfers to the United States, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission or the service provider's certification under applicable data protection frameworks. You may refuse the overseas transfer of your personal information by contacting us, though this may limit your ability to use certain features of the service.

Cookies and Tracking Technologies

TextFight uses cookies and similar technologies to operate the service. You have the right to refuse the installation of cookies (except essential cookies) through your browser settings.

• Essential cookies — authentication session cookies managed by Supabase Auth (secure httpOnly cookies using PKCE flow). These are strictly necessary for the service to function and cannot be disabled
• Functional cookies — remember your game preferences and UI settings
• Advertising cookies — Google AdSense cookies for serving and personalizing advertisements. You can opt out via Google Ad Settings or your browser's cookie settings
• Analytics cookies — help us understand how players use the game to improve the experience

To refuse cookies: Most web browsers allow you to control cookies through their settings. You can set your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you disable essential cookies, you may not be able to use TextFight. For advertising cookies, you may opt out through the Network Advertising Initiative (optout.networkadvertising.org) or Digital Advertising Alliance (optout.aboutads.info).

AI Processing and Automated Decision-Making

TextFight uses artificial intelligence (OpenAI and Google Gemini) to generate battle narratives and determine battle outcomes. When you initiate a battle, your fighter name, description, traits, and battle context are sent to AI providers for processing. The AI generates a narrative and selects a winner based on creativity, humor, and specificity — not on power level or pay-to-win mechanics.

We do not use your personal information (email, real name, IP address) in AI prompts. Only game-related data (fighter information) is processed by AI services.

You have the right to request information about the logic involved in automated decisions that significantly affect you. Battle outcomes are determined algorithmically and are final, but you may contact us with questions about how the AI judging system works.

Security Measures

We implement technical, administrative, and physical security measures to protect your personal information:

• Technical — encryption of data in transit (TLS/HTTPS), secure httpOnly cookies for authentication, hashed passwords, Row Level Security (RLS) policies on all database tables, webhook signature verification for payment processing
• Administrative — access controls limiting employee access to personal data on a need-to-know basis, regular security reviews of third-party integrations
• Physical — data stored on cloud infrastructure (Supabase/AWS, Render) with industry-standard physical security controls

Despite our efforts, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your personal information.

Data Sharing and Public Disclosure

Certain information you provide is publicly visible by design:

• Public profiles — your username, battle statistics, and fighter information are visible on your public profile page
• Shared battles — when you share a battle, the battle narrative and fighter names become publicly accessible via a share link
• Leaderboards — your username, fighter names, and ELO ratings are displayed on public leaderboards

We may also disclose your information if required by law, court order, or governmental request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Children's Privacy

TextFight is intended for users aged 16 and older. We do not knowingly collect personal information from anyone under the age of 16. If you are under 16, you may not use TextFight.

If you are a parent or guardian and believe your child under 16 has provided us with personal information, please contact us at textfight99@gmail.com so we can promptly delete such information.

Your Rights

Regardless of your location, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — request correction of inaccurate or incomplete personal data
• Deletion — request deletion of your personal data
• Suspension of processing — request that we stop processing your personal data

To exercise any of these rights, please contact us at textfight99@gmail.com. We will respond to your request within 30 days. The method to exercise your rights is no more difficult than the method used to collect your information. We will not treat you differently for exercising your rights.

Additional Information for Korean Users

This section provides additional information required under the Korean Personal Information Protection Act (PIPA).

Chief Privacy Officer (CPO): morpi, textfight99@gmail.com. The CPO is responsible for overseeing all matters related to personal information protection and handling complaints.

You may file a complaint regarding personal information protection with: the Personal Information Protection Commission (pipc.go.kr), the Korea Internet & Security Agency (privacy.kisa.or.kr), the Supreme Prosecutors' Office Cyber Investigation Division (spo.go.kr), or the Korean National Police Agency Cyber Bureau (ecrm.police.go.kr).

We will notify you of any changes to the entrustment of data processing or overseas transfer arrangements through updates to this Privacy Policy.

Additional Information for EU/EEA Users

This section provides additional information required under the General Data Protection Regulation (GDPR).

Legal bases for processing are detailed in the "Legal Basis for Processing" section above. Where we rely on consent, you may withdraw your consent at any time by contacting us. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

In addition to the rights listed above, EU/EEA users have the right to: data portability (receive your data in a structured, machine-readable format), object to processing based on legitimate interests, and lodge a complaint with your local data protection supervisory authority.

We do not currently have a designated EU representative under Article 27 of the GDPR. If we meet the applicable thresholds, we will designate one and update this policy accordingly.

Additional Information for California Residents

This section provides additional information as required by the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

Categories of personal information collected in the preceding 12 months: identifiers (email, username, IP address, user ID), internet activity information (browsing history, gameplay data, battle records), commercial information (purchase history, coin balance), and inferences drawn from the above (ELO ratings, trait discoveries).

We do not sell or share your personal information for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes other than those permitted under the CCPA.

California residents have the right to: know what personal information is collected, request deletion of personal information, request correction of inaccurate personal information, opt out of the sale or sharing of personal information (we do not sell or share), and non-discrimination for exercising privacy rights.

To submit a request, contact us at textfight99@gmail.com. We will verify your identity before processing your request. You may also designate an authorized agent to make a request on your behalf.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page, updating the "Last Updated" date, and where appropriate, sending a notification via the Service. We encourage you to review this Privacy Policy periodically.

Continued use of TextFight after changes are posted constitutes acceptance of the revised policy.

Contact Us

If you have any questions about this Privacy Policy, our data practices, or wish to exercise your rights, please contact us:

morpi — --201, -, 9 Daecheongbuk-gil 17beon-gil, Jung-gu, Busan, 48969, Republic of Korea

Email: textfight99@gmail.com