Privacy Policy

At a glance

winterlog studio ("we", "us") makes and runs the Mac app TTANG TTANG Buddies. This policy explains how we handle personal data in the app (the Mac App Store edition and the web edition) and on our site (buddies.bang9.dev).

• There is no sign-up, and the app doesn't ask for your name, email or phone number.
• Key presses are only counted. With the Input Monitoring permission, the app only learns when and how many times keys are pressed. It never reads which key or letter, and never saves or sends it anywhere.
• Your progress (friends, paws, painted ground) is saved on your Mac, and a copy is backed up to our server so you can restore it on a new Mac.
• We collect usage events, such as opening the app or the wardrobe, with a device analytics ID for our own statistics. When you pay, we also attach this ID to the payment to count which device the purchase came from. There are no ads.
• Payments are handled by Apple for the Mac App Store edition and by Dodo Payments for the web edition, as merchants of record. Only those companies see your card details.
• Our server (Cloudflare), purchase checks (RevenueCat) and web edition payments (Dodo Payments) are US companies, so personal data is transferred abroad (sent to, or viewed from, another country).
• Send questions and deletion requests to support@bang9.dev.

Who is responsible for your data

We are the controller of personal data in this app (the party that decides how it is handled and is responsible for it).

• Business name: winterlog studio
• Owner: Hyungu Kang
• Address: 5-12 Gwangmyeong-ro 347beon-gil, Jungwon-gu, Seongnam-si, Gyeonggi-do, Republic of Korea
• Email: support@bang9.dev
• Phone: +82 10 9688 1157

Full business details are in Business information (Korea).

Privacy contact

Our privacy contact is the owner, Hyungu Kang. Send privacy questions, requests to see or delete your data, and complaints to:

• Email: support@bang9.dev
• Phone: +82 10 9688 1157

Why we use your data

We don't process any personal data on the basis of consent. Input Monitoring only turns on when you allow it in the macOS permission prompt, and you can turn it off at any time in System Settings.

What data we collect and where it comes from

• Key presses: when and how many times keys are pressed. The app uses what macOS reports only inside the app and keeps just the daily total of key presses in the device save. It never reads which key or letter.
• Data created on your device as you use the app: your friends and the names you give them, affection, paws (in-app currency) and items you own, painted ground, daily records (key presses, painted tiles, finished boards), pet position, settings
• Save backup: a copy of the device save above, an owner key (the RevenueCat anonymous ID for the Mac App Store edition, the license key ID for the web edition — stored on our server only as a hash), save version, last-changed time and size
• Analytics created automatically: event names (app opened, first run finished, permission allowed, wardrobe opened, purchase started, purchase finished, key activated), fixed event values (edition, first animal chosen, product), device analytics ID (made from the time you first opened the app), device language, country (worked out from your IP address; we don't store the IP address)
• When you buy in the Mac App Store edition: store receipt (product, amount, country, time), RevenueCat anonymous ID, device analytics ID (attached to your RevenueCat purchase details). Only Apple sees your card details. So that your other Macs signed in to the same Apple Account are treated as the same buyer, the app keeps one RevenueCat anonymous ID in your iCloud (key-value storage).
• When you buy the web edition: Dodo Payments collects your name, email and payment details directly; they don't reach our server. From the payment notice we receive the payment and customer IDs (kept only as hashes), product, amount, country and time. When it opens the payment page, the app attaches the device analytics ID to the payment, so at Dodo Payments this ID is tied to the same payment as the buyer's name and email. When you activate or check a license key, the app sends Dodo Payments the key and a random device name the app made up (for example mac-1a2b3c4d).
• Server access: IP address, access time, requested URL, app and browser information
• Support email: your email address and what you write

Data kept only on your device

When and how many times keys are pressed is used only to move your pet on your Mac and is never sent to a server. Friends, paws, items, painted ground and settings are kept in the app's storage on your Mac. A copy of this save is backed up to our server as described in the next sections.

Web edition license keys are also kept in the app's storage on your Mac (for paw pack keys, only a fingerprint that tells whether the key was already used, not the key itself). This storage stays on your Mac even after you move the app to the Trash. To erase everything, delete the app, then in Finder choose Go → Go to Folder, open ~/Library/Containers/dev.bang9.ttangpet and move that folder to the Trash.

How long we keep data

Where the law sets a retention period, the legal basis is shown under the period in the table. We keep those records separately and only for that period.

How we delete data

When the retention period ends or the purpose is fulfilled, we delete the data without delay so it can't be recovered.

• If you email support@bang9.dev, we delete your save backup from the database and don't restore it. Please tell us whether you use the Mac App Store edition or the web edition.
• Our analytics records are linked only to a device analytics ID and are deleted automatically by the storage service when the retention period ends. We can't pick out and delete single records.
• Payment records are deleted when the period set by law ends.
• We don't keep any paper records.

Service providers we use

We use the providers below to run the app. Through their data processing terms, our processors must protect personal data to the same standard as this policy. Their sub-processors are listed by each provider.

Apple (Mac App Store) and Dodo Payments handle payments as merchants of record that deal with you directly, so they handle payment data under their own policies. Because this may count as providing data to a third party (passing it to another party for its own purposes), we list them in the table below.

If we change providers or what they do for us, we will update this policy.

Data sent to other countries (international transfers)

• When and how: as needed while you use the app and the site, over the internet (encrypted connection).
• Legal basis: Korean PIPA Art. 28-8(1)3 (outsourcing and storage needed to perform the contract, disclosed in this policy). For users in the EEA and UK, data is protected by the adequacy decision for Korea (us) and by the US providers' EU-US Data Privacy Framework certification or standard contractual clauses.
• To refuse: block the app's internet connection. Your pet keeps working offline, but save backup, payments and restores, and web edition license checks won't work.

On-device storage and SDKs

Our site (buddies.bang9.dev) doesn't store cookies and doesn't load other companies' scripts or fonts. If you pick a language, only that choice is kept in your browser's storage.

The app keeps a device analytics ID and your progress save (and, in the web edition, your license key) on your Mac. The RevenueCat SDK in the Mac App Store edition sends Mac information to RevenueCat to check purchases, and the web edition asks Dodo Payments directly when you activate or check a license key. There are no ad SDKs, advertising IDs or tracking pixels.

External Transmission Disclosure (Japan)

Under Article 27-12 of Japan's Telecommunications Business Act, we disclose the information TTANG TTANG Buddies sends from your Mac to other companies. Save backups and analytics sent to our own server (Cloudflare) are received by us, so they aren't included here; they are in "Tools" above.

Children's data

This app is not directed at children under 13 (under 14 in Korea; in the EEA, under the age at which you can consent to data processing on your own in your country — 13–16 depending on the country). The app doesn't ask your age, doesn't collect names or contact details, and has no way to talk with other people. If we learn that we have collected personal data from someone younger than this, we delete it. Parents and guardians can ask to see or delete data at support@bang9.dev.

Your rights and how to use them

You can ask at any time to see, correct or delete your personal data, or to stop processing it. Where the law provides, you can also ask for a copy to take elsewhere (portability) and object to processing.

• Stop key counting: turn off TTANG TTANG Buddies in System Settings → Privacy & Security → Input Monitoring. Petting, tossing and dressing up still work.
• Erase data on your device: delete the app and the app storage folder that stays on your Mac (~/Library/Containers/dev.bang9.ttangpet).
• See or delete your save backup or payment records, or download your save backup: email support@bang9.dev.

We reply within 10 days as required by the Korean Personal Information Protection Act and, if we need longer, tell you why and when to expect a reply. To confirm it's you, we may ask you to verify a receipt or license key. You can also make a request through a legal representative or someone you authorize.

How we keep data safe

• All communication with our server is encrypted (HTTPS).
• The app uses a listen-only method that only receives when and how many times keys are pressed, so it neither changes nor reads what you type.
• Owner keys for save backups and customer IDs in payment records are stored only as hashes. Our server has no fields for names, emails or card details.
• Payment notices are checked by signature to block fake payments.
• Only we can access the server and provider dashboards, and passwords and keys are kept in an encrypted secret store.

Where to get help

If you need help with a privacy problem in Korea, you can contact:

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
• Korean National Police Agency, Cyber Bureau: 182 (ecrm.police.go.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)

Users in other countries can complain to the authorities listed in the annexes below.

Changes to this policy

This policy (version 1) was announced on October 1, 2026 and takes effect on October 1, 2026. If we change this policy, we'll announce it on this page before the change takes effect (on the effective date at the latest) and show what changed side by side with the previous version. If a new purpose or a new recipient is added, we'll tell you before that processing starts and ask for your consent where the law requires it.

Previous versions: None

Language

This document was originally written in Korean. Translations are provided for convenience. If they differ, the original prevails, unless the law of the country where you live says otherwise.

Annex: EEA, UK and Switzerland

• The controller is us (see "Who is responsible for your data" above).
• The legal bases are in the purposes table above: performance of a contract (GDPR 6(1)(b)) and legitimate interests (6(1)(f)).
• You can object at any time to processing based on legitimate interests (our statistics, server security) (GDPR Art. 21), and we will stop unless we have compelling grounds.
• Your rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21). Send requests to support@bang9.dev.
• Complaints: you can complain to the data protection authority in your country (ICO in the UK, FDPIC in Switzerland). If a UK user sends us a complaint, we will acknowledge it within 30 days as required by the UK Data (Use and Access) Act 2025.
• We don't make automated decisions or do profiling that has legal effects.
• Device storage: the app keeps your progress save and a device analytics ID on your device.
• International transfers: see the transfers table above.

Annex: United States (California and other state laws)

• Categories collected in the past 12 months: identifiers (device analytics ID, RevenueCat anonymous ID, license key ID), commercial information (purchase records), internet activity (app events), approximate location from IP (country). We don't collect sensitive personal information.
• Sources, purposes, recipients and retention are as in the tables above.
• Sale and sharing: we don't sell personal information or share it for targeted advertising. There are no ads or ad tracking tools.
• Your rights: to know, delete and correct. We won't discriminate against you for using them. You can use an authorized agent, and we may ask to verify your identity. If we deny a request, you can appeal by writing to support@bang9.dev.
• Do Not Track: the site and the app have no third-party tracking tools, so a browser's DNT signal doesn't change anything.
• If anything changes, we'll update this policy and its effective date.

Annex: Japan

• Business handling personal information: winterlog studio, owner Hyungu Kang, address 5-12 Gwangmyeong-ro 347beon-gil, Jungwon-gu, Seongnam-si, Gyeonggi-do, Republic of Korea.
• Purposes of use: see the purposes table above.
• Send requests for disclosure, correction, suspension of use or deletion of retained personal data, or for disclosure of records of provision to third parties, to support@bang9.dev. There is no fee.
• Security measures: see "How we keep data safe" above. Foreign systems: Korea, where we are based, has the Personal Information Protection Act; the US, where our providers are, has no comprehensive federal privacy law but has state laws such as the California Consumer Privacy Act. We have set security measures with our providers through their data processing terms.
• Complaints: support@bang9.dev

Annex: Brazil (LGPD)

• Controller (controlador): winterlog studio. Data protection officer (encarregado): Hyungu Kang, support@bang9.dev.
• Legal bases (LGPD Art. 7): performance of a contract (V), legitimate interest (IX).
• Rights (Art. 18): confirmation of processing, access, correction, anonymization, blocking or deletion, portability, information about shared use. You can petition the National Data Protection Authority (ANPD).
• International transfers: Transferência internacional de dados pessoais.

Annex: Mexico

• Responsible party (responsable): winterlog studio, address 5-12 Gwangmyeong-ro 347beon-gil, Jungwon-gu, Seongnam-si, Gyeonggi-do, Republic of Korea.
• Primary purposes: providing the pet app, save backup and purchase checks. Secondary purpose: our own statistics. To object to the secondary purpose, write to support@bang9.dev.
• ARCO rights (access, rectification, cancellation, objection): send requests to support@bang9.dev, and we will reply within the legal period.
• Transfers: to the companies in the transfers table above.

Annex: Chile

Under Chile's personal data law (Law 19.628, and Law 21.719 from December 1, 2026) you can ask for access, rectification, deletion, objection, portability and blocking. Email support@bang9.dev and we will reply within the legal time limit. Our legal bases are in the purposes table above. From December 1, 2026 you can complain to the Personal Data Protection Agency (Agencia de Protección de Datos Personales).

Annex: Colombia

Under Colombian Law 1581 of 2012 you can know, update and correct your data, ask for deletion and revoke your authorization. Email support@bang9.dev: we answer queries within 10 business days and claims within 15 business days. You can complain to the Superintendence of Industry and Commerce (SIC).

Annex: Argentina

Under Argentine Law 25.326 you can access your data free of charge every six months (Art. 14(3)) and ask for correction or deletion. Send requests to support@bang9.dev. You can complain to the Agency for Access to Public Information (AAIP).

Annex: Canada

Our privacy officer is the owner, Hyungu Kang (support@bang9.dev). Under PIPEDA and Quebec's Law 25 you can ask to access and correct your data. You can complain to the Office of the Privacy Commissioner of Canada (OPC) or, in Quebec, the Commission d'accès à l'information (CAI).

Annex: Australia

Under the Australian Privacy Principles (Privacy Act 1988) you can ask to access and correct your data; email support@bang9.dev and we reply within the time the law requires. Your data goes to US providers (see the transfer table above). If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC).

Annex: India

Our grievance officer under India's Digital Personal Data Protection Act 2023 is Hyungu Kang (support@bang9.dev). You can ask for a summary of processing, correction or erasure, and to nominate someone to act for you in case of death or incapacity. If it isn't resolved, you can go to the Data Protection Board of India.

Annex: Vietnam

Under Vietnam's Personal Data Protection Law (in force from January 1, 2026), you have the right to be informed about processing, and to access, correct, delete, restrict and object to processing. Your data is transferred outside Vietnam as in the transfers table above. Send requests to support@bang9.dev.

Annex: Switzerland

Under the Swiss Federal Act on Data Protection you can ask for access, correction, deletion and portability, and complain to the Federal Data Protection and Information Commissioner (FDPIC). Transfers to US providers are protected by the Swiss-US Data Privacy Framework or standard contractual clauses.

Annex: Türkiye

Under Article 11 of the Turkish Personal Data Protection Law (KVKK No. 6698) you can ask whether your data is processed, request information, learn the purpose and the recipients, ask for correction or deletion, object to results of automated analysis, and claim compensation. Send requests to support@bang9.dev. You can complain to the Personal Data Protection Authority (KVKK). International transfers are as in the table above.

Annex: Indonesia

Under Indonesia's Personal Data Protection Law (Law 27/2022), you have the right to information, correction, access and deletion, and to object to automated decisions. Send requests to support@bang9.dev. Your data is transferred outside Indonesia as in the transfers table above.

International Transfers of Personal Data (Brazil)

Personal data of users in Brazil is transferred outside Brazil as shown below.

• Recipients: us (winterlog studio, Korea) and the US providers in the table.
• Mechanism and legal basis: transfers needed to perform the contract (LGPD Art. 33 IX), providers' data processing terms and standard contractual clauses (Art. 33 II).
• Purposes and periods: see the purposes table and the retention table above.
• Responsibility: we are responsible for protecting the transferred data.
• Rights: you have the same LGPD Art. 18 rights; send requests to support@bang9.dev.
• Onward transfers: providers may pass data to their own sub-processors, and we require the same level of protection by contract.