BREYES Privacy Policy
Effective: October 6, 2026
Updated October 7, 2026: InkScene Studio collaboration now uses P2P. Artwork is not stored on the server, and room artwork stored by the previous implementation has been deleted.
This English version is a translation provided for convenience. If it differs from the Korean version, the Korean version prevails.
BREYES (the “Operator”) handles only what is needed to provide games and tools, and does not ask for anything that identifies you directly, such as your name, phone number or address. We use no advertising or analytics tracking tools. Under the Korean Personal Information Protection Act, this policy explains what information we process, why, for how long and where.
1. Scope
This policy applies to the web games and tools (including InkScene Studio), feedback, breyes.net account and contact email at www.breyes.net and the addresses under it. The following services have their own policies.
- Iron Crown (realm.breyes.net): Iron Crown Privacy Policy
- AFTERFIRE (app and web version): AFTERFIRE Privacy Policy
- Apps distributed on Google Play and Steam: the privacy policy linked from each app’s store page
- The sign-up consent items of the breyes.net account: breyes.net account notice (Korean)
2. What we process, why, and for how long
Any page visit
| Items | Web server access log: date and time, IP address, requested address (including room codes in invite links), information your browser sends (browser and OS type, previous page address, language) |
|---|---|
| Purpose | Responding to security incidents, blocking excessive requests, visit statistics (statistics use an irreversibly converted value and an approximate region instead of the IP address) |
| Kept for | Up to 3 months (Protection of Communications Secrets Act), then deleted automatically |
Party games — Doodle Party, Splash Battle, Breach Squad, Birdie Nine, Duet Beat, Nova Guard, Dungeon Brawlers
| Items | Nickname, chat, drawings and emotes, room code, a random player number made when you connect, IP address (to limit simultaneous connections) |
|---|---|
| Purpose | Showing them to players in the same room, showing the host’s nickname in the public room list and invite link previews, moving a room to another game, preventing abuse |
| Kept for | Held only in server memory and deleted within 30 seconds after the room ends or you disconnect (chat keeps only the last 30–40 lines per room). Everything is gone when the server restarts; nothing is written to disk or logs |
NEON BREACH co-op
| Items | A connection ID containing the room code, IP address, the connection offers the two devices exchange (which contain IP addresses), and game data relayed by the Operator’s server when a direct connection fails (encrypted between the devices, so the Operator cannot read it) |
|---|---|
| Purpose | Connecting and relaying between two devices |
| Kept for | Held only in server memory and deleted when the connection ends; nothing is written to disk or logs |
TENPOP
| Items | An anonymous cookie value (stored on the server converted with SHA-256), the moves and score of random and daily challenges, the nickname you enter when you submit a score, IP address (rate limiting, memory only) |
|---|---|
| Purpose | Verifying scores, publishing daily and 30-day rankings |
| Kept for | Individual runs 30 days, daily bests up to 62 days, anonymous numbers without records deleted after 366 days |
BATTLE MINESWEEPER
| Items | An anonymous cookie value, nickname, match results and moves (for replays), anti-cheat check records |
|---|---|
| Purpose | Providing rankings and replays, preventing cheating |
| Kept for | Kept while the rankings are run, and deleted without delay on request |
Pogeun Pogeun
| Items | Neighbour code and garden card (pet names, looks and decorations; nothing about the person), footprints and gifts, save files for moving to another device, the neighbour code’s secret (stored converted with SHA-256), IP address (rate limiting, memory only) |
|---|---|
| Purpose | Neighbour visits and gifts, moving to another device |
| Kept for | Neighbour codes not visited for 180 days deleted, footprints 7 days, transfer files 24 hours or until picked up once. Can be deleted at once with “Delete our neighbor code” in the game |
InkScene Studio — drawing tool
| Personal work and autosave | Artwork, autosaves and recovery copies, materials and brush settings are stored in your browser. Artwork is not uploaded to or stored on the server. |
|---|---|
| P2P collaboration | The entire artwork (all pages, strokes and layers, embedded images, audio, 3D materials and credits), edits and cursors travel between participants' browsers over encrypted WebRTC connections. Participants may save artwork on their own devices. Directly connected participants can learn each other's IP addresses. |
| Connection signaling | The Operator's server processes room codes, random participant IDs, nicknames and signaling information (SDP and ICE, including IP addresses needed to connect) only in memory while connected. The Operator's TURN may relay encrypted packets when a direct connection is unavailable. Artwork and edits are not written to server files, databases or logs. |
| Purpose and retention | P2P editing and connections chosen by the user. Room information is released from server memory when the last participant leaves. There is no server artwork copy to restore; after everyone leaves, a participant retaining the artwork must reopen the room. Autosaves, recovery copies and separately saved participant copies remain on their respective devices. |
Sending feedback
| Items | The message, its type, page and time sent; the operator’s reply; a receipt number (stored converted); device type (OS and browser); the region found from the IP address (country and province; the IP address itself is not stored) |
|---|---|
| Purpose | Checking bugs, improving the service, delivering replies |
| Kept for | Deleted one year after it is sent |
breyes.net account (optional)
| Items | Username and password (stored converted with scrypt) or the Google/Kakao member identifier, login sessions (stored converted), saves of games where you turned on “Keep”, and the device type that saved them (phone, tablet or PC) |
|---|---|
| Purpose | Login, continuing the same save across devices |
| Kept for | Until you delete the account; “Delete account” deletes it immediately. Sessions unused for 400 days are deleted automatically |
Contact email
| Items | The sender’s email address and the message |
|---|---|
| Purpose | Answering inquiries |
| Kept for | Kept for one year after the reply, then deleted |
Most games keep progress, nicknames and settings only in your browser; the Operator does not have them. Operating statistics such as player counts are numbers only and contain nothing that identifies a person.
3. What other players can see
- Nicknames, chat and drawings are visible to players in the same room. The host’s nickname is shown in party games’ public room lists and invite link previews, and the nicknames and scores you submit are public on the TENPOP and BATTLE MINESWEEPER rankings.
- Duet Beat and NEON BREACH connect two players’ devices directly to reduce lag. Each device then learns the other’s IP address. For both games, the server that helps them connect is the Operator’s own server in Seoul.
Anyone who knows an InkScene Studio invite link or room code can view, edit and save all pages and embedded materials in that room. Room participants can also see nicknames and cursors. There is no login, per-participant permission setting or invitation revocation, so share links only with people you trust. The Operator cannot recall copies participants save separately.
4. Outsourcing of processing
| Processor | Task | Location |
|---|---|---|
| The Constant Company, LLC (Vultr) | Hosting the web, game and account servers and storage (the processor only rents out the servers and does not access the data stored on them) | Seoul, Republic of Korea |
All servers run by the Operator are in Seoul, Republic of Korea. The international transfers in section 5 are also outsourcing.
5. International transfers
The following transfers are outsourcing and storage needed to provide the service you request, disclosed in this policy under Article 28-8 of the Personal Information Protection Act. Each item is sent over an encrypted connection (HTTPS, TLS or similar) when your browser connects to the server concerned.
5-1. Loading fonts (Google Fonts)
| Recipient (contact) | Google LLC (privacy contact form) |
|---|---|
| Country | The United States and other countries where Google operates data centers |
| Items | IP address, browser information, address of the page requesting the font |
| When | When you open the Doodle Party, Splash Battle, Breach Squad, NEON BREACH, AQUARELLE or Pogeun Pogeun pages |
| Purpose and retention | Displaying fonts. Kept as set by Google’s policies |
| How to refuse, and the effect | Don’t open those games, or block fonts.googleapis.com in your browser; the page then uses default fonts. |
5-2. Delivering large game files and forwarding contact email (Cloudflare)
| Recipient (contact) | Cloudflare, Inc. (privacyquestions@cloudflare.com) |
|---|---|
| Country | The United States and other countries where Cloudflare operates servers (you may be routed to a server abroad even from Korea) |
| Items | cdn.breyes.net: IP address, browser information, requested file address · contact@breyes.net: the sender’s email address and the message |
| When | When AQUARELLE, Yeoul, Pogeun Pogeun or the AFTERFIRE web version download art and model files · when you email contact@breyes.net |
| Purpose and retention | Delivering game files; forwarding mail to the Operator’s mailbox (5-3). Mail is forwarded, not stored; otherwise kept as set by Cloudflare’s policies |
| How to refuse, and the effect | Don’t open those games. You can contact us with “Send feedback” instead of email. |
5-3. Storing contact email (Gmail)
| Recipient (contact) | Google LLC (privacy contact form) |
|---|---|
| Country | The United States and other countries where Google operates data centers |
| Items | The sender’s email address and the message |
| When | When you email contact@breyes.net |
| Purpose and retention | Answering inquiries. Kept for one year after the reply, then deleted |
| How to refuse, and the effect | Use “Send feedback” instead of email; nothing is then transferred abroad. Feedback does not ask for an email address. |
6. If we add servers abroad
We may put game servers in other countries to make the games faster for players abroad. If we do, then before such a server goes into use we will add to section 5 the company running it and its contact details, the country, the items sent to it (such as the IP address, nickname and game input of players who connect), when and how they are sent, the purpose, the retention period and how to refuse, and post the change on this page 7 days before it takes effect. If information we keep long-term, such as accounts or feedback, is moved to a server abroad, we will announce that in the same way.
7. Cookies and browser storage
| Name | Used by | Purpose | Lasts |
|---|---|---|---|
tenpop_player | TENPOP (sent only to /tenpop/) | Grouping one player’s records | 1 year |
mine_session | BATTLE MINESWEEPER | Grouping one player’s ranking records | 1 year |
breyes_sid | breyes.net account (sent only to /account/api/) | Staying logged in | 400 days (extended with use) |
breyes_oidc | breyes.net account | Checking a Google/Kakao login in progress | 10 minutes |
Scripts in the browser cannot read these cookies. Values such as nicknames, settings, game progress and feedback receipt numbers are kept in browser storage (localStorage and sessionStorage), and only what a game needs is sent to the server when it is used. Clearing your browser’s site data removes them.
InkScene Studio keeps artwork, recovery copies and materials in IndexedDB, nicknames and custom brush settings in localStorage, and caches app files for offline use. Clearing site data, or the browser reclaiming storage, may remove these records. Save a project file first. Clearing browser data does not delete copies saved on other participants’ devices. The collaboration server holds no artwork copy.
8. Provision to third parties
The Operator does not provide your personal information to third parties, except where the law requires it, such as a request from an investigative agency through the legal procedure. When you log in with Google or Kakao, you go through that company’s login screen, and the information processed there is governed by that company’s privacy policy. The Operator receives only the member identifier from them.
9. How information is destroyed
Information whose retention period has ended, or whose purpose has been fulfilled, is destroyed without delay. The servers enforce most of the periods above automatically; electronic records are deleted so they cannot be restored, and we keep no personal information on paper. Feedback is stored on the Iron Crown server, so after deletion it may remain in disaster-recovery backups for up to 30 days before disappearing with them.
10. Security measures
- All pages and game traffic are encrypted with HTTPS (TLS).
- Passwords are stored converted with scrypt, and sessions, cookie values and receipt numbers with SHA-256.
- Only the Operator can access the servers and admin screens, and server logins are allowed only with access keys, never passwords.
- Game servers run without write access, and their logs record no IP addresses, nicknames or chat.
- Login attempts and request rates are limited.
11. Children under 14
Only people aged 14 or over can create a breyes.net account. Games without an account do not ask for names or contact details, and if we learn that we are processing information of a child under 14, we delete it without delay.
12. Your rights and how to exercise them
You may at any time request access to, correction, deletion or suspension of processing of your personal information, withdraw consent, and ask us to stop an international transfer, and the Operator will act without delay. You can delete your account and kept saves on the account screen and your Pogeun Pogeun neighbour code in the game; records tied to a cookie (TENPOP, BATTLE MINESWEEPER) are deleted on request to the email below. Because records identified only by a cookie are hard to verify, please include the nickname shown in that browser and roughly when you played.
InkScene Studio artwork is kept on users’ devices, so the Operator cannot directly access or delete it. Use the email below for inquiries. Do not post room codes publicly, as they grant editing access to artwork held by connected participants.
13. Privacy officer and contact
| Privacy officer | The operator of BREYES |
|---|---|
| contact@breyes.net |
You can also report or seek advice about privacy infringements from the following Korean bodies.
- Personal Information Infringement Report Center (privacy.kisa.or.kr, 118 within Korea)
- Personal Information Dispute Mediation Committee (www.kopico.go.kr, +82 1833-6972)
- Supreme Prosecutors’ Office Cyber Investigation Division (1301 within Korea) · Korean National Police Agency Cyber Bureau (182 within Korea)
14. Changes to this policy
If we change this policy, we will post the changes and their effective date on this page 7 days before they take effect. Changes that are unfavourable to users, such as collecting more items, will be posted 30 days in advance. When a new game opens and the information it processes matches the table above, we may simply add its name to the table.
This policy takes effect on October 6, 2026.