Privacy Policy

At a glance

winterlog studio ("we", "us") makes and runs the Mac app TTANG TTANG Buddies. This policy explains how we handle personal data in the app and on our site (buddies.bang9.dev).

• There is no sign-up, and the app takes no name, email or phone number from you.
• Key presses are only counted. With the Input Monitoring permission, the app only learns when and how many times keys are pressed, and uses that only on your Mac to move your pet (Data kept only on your device).
• Paws (in-app currency) and items you own are kept in a wallet on our server so they look the same on the same buyer's Macs. The rest of your progress (friends, affection, painted ground) is saved on your Mac, and a copy is backed up to our server so you can pick it up on a new Mac. The backup never includes key-press counts, and you can turn it off or delete it in the app's settings.
• We collect usage events, such as opening the app or the wardrobe, with a device analytics ID for our own statistics. When you pay, we also attach this ID to the payment to count which device the purchase came from.
• On our site (buddies.bang9.dev), we count which posts and ads bring people to download or buy, and we use Google Analytics and Meta's ad measurement to analyze visits and see how ads perform. In the EEA, UK and Switzerland we only do this after you agree, and elsewhere you can turn both off in Your Privacy Choices.
• Payments are handled by Apple as the merchant of record (the company that takes payment, handles tax and pays refunds). Only Apple sees your card details.
• Our server (Cloudflare), purchase checks (RevenueCat) and visit analysis and ad measurement on the site (Google, Meta) are US companies, so personal data is transferred abroad (sent to, or viewed from, another country).
• Send questions and deletion requests to Privacy contact.

Privacy contact

We are the controller of personal data in this app (the party that decides how it is handled and is responsible for it). Our privacy contact is the owner, Hyungu Kang.

• Business name: winterlog studio
• Owner: Hyungu Kang
• Address: 5-12 Gwangmyeong-ro 347beon-gil, Jungwon-gu, Seongnam-si, Gyeonggi-do, Republic of Korea
• Email: support@bang9.dev
• Phone: +82 10 9688 1157

Send privacy questions, requests to see or delete your data, and complaints to the email or phone above. Full business details are in Who we are and business information.

Why we use your data

What data we collect and where it comes from

• Key presses: when and how many times keys are pressed. The app uses this only inside the app and keeps just the daily total in the device save.
• App progress: your friends and the names you give them, affection, paws (in-app currency) and items you own, painted ground, daily records, settings
• Save backup: a copy of your friends, painted ground, daily records and settings from the progress above, and a buyer identifier (the RevenueCat anonymous ID). The app uploads it from time to time while you use it and when you quit.
• Wallet: records of paws earned, spent and bought, what payments added and refunds took back, and a buyer identifier
• App usage records (created automatically): opening the app and first run, Input Monitoring permission status, daily play, wardrobe and shop use, payment steps, settings changes, and whether you took over a save backup; plus a device analytics ID, device language and country (we don't store the IP address)
• Site usage records: pages viewed and buttons pressed, a browser analytics ID, how you arrived (ad information in the link and the site you came from), browser language and country (we don't store the IP address). If you allow ad and analytics tools, Google Analytics and the Meta Pixel set cookies and send pages viewed, site events and connection information (IP address, browser information) to Google and Meta.
• When you buy in-app products: store receipt (product, amount, country, time), RevenueCat anonymous ID, device analytics ID. Only Apple sees your card details. So that your other Macs signed in to the same Apple Account are treated as the same buyer, the app keeps a buyer identifier in your iCloud.
• Server access: connection information (IP address, access time, requested URL, app and browser information)
• Support email: your email address and what you write

Data kept only on your device

The app never reads which key or letter. When and how many times keys are pressed is used only to move your pet on your Mac and is never sent to a server. The save backup doesn't include key-press counts either. Your progress and buyer identifier are kept in the app's storage on your Mac, and a copy of the progress is uploaded to our server, as described under save backup in 'What data we collect and where it comes from'.

This storage stays on your Mac even after you move the app to the Trash. To erase everything, delete the app, then in Finder choose Go → Go to Folder, open ~/Library/Containers/dev.bang9.ttangpet and move that folder to the Trash.

How long we keep data and how we delete it

Where the law sets a retention period, the legal basis is shown under the period in the table. We keep those records separately and only for that period.

When the retention period ends or the purpose is fulfilled, we delete the data without delay so it can't be recovered.

• You can delete the save backup right away by pressing 'Delete server backup' in the app's settings. If backup is on in another Mac of the same buyer, that Mac uploads it again, so turn backup off there too.
• When you ask us to, we delete your wallet and save backup from the database and don't restore them. Deleting the wallet also removes its paws and items.
• Our analytics records (app and site) are linked only to an analytics ID and are deleted automatically by the storage service when the retention period ends. We can't pick out and delete single records. The site's browser analytics ID and first way in disappear when you clear the site data in your browser.
• Payment records are deleted when the period set by law ends.
• We don't keep any paper records.

Who receives data (third parties, service providers, international transfers)

Provision to third parties

The companies below also use the data they receive for their own purposes, under their own policies. Because this may count as providing data to a third party (passing it to another party for its own purposes), we list them here.

• Payments: Apple (Mac App Store) handles payments as a merchant of record that deals with you directly, so it handles payment data under its own policies.
• Ad measurement on the site: Meta uses the data it receives to measure how ads perform and, under Meta's policy, also to choose and improve ads. In Korea, we treat this as ad measurement work we outsource to Meta (outsourcing — having someone process data on our behalf) and disclose it in this policy. In the EEA, UK and Switzerland, we only send data of visitors who agreed.

Some US state laws treat sending data for ad measurement as "sharing". You can opt out in Your Privacy Choices.

Service providers

We use the providers below to run the app. Through their data processing terms, our processors must protect personal data to the same standard as this policy. Their sub-processors are listed by each provider.

If we change providers or what they do for us, we will update this policy.

International transfers

• When and how: as needed while you use the app and the site, over the internet (encrypted connection).
• Legal basis: Korean PIPA Art. 28-8(1)3 (outsourcing and storage needed to perform the contract, disclosed in this policy). For users in the EEA and UK, data is protected by the adequacy decision for Korea (us) and by the US providers' EU-US Data Privacy Framework certification or standard contractual clauses.
• To refuse: block the app's internet connection. Your pet keeps working offline, but save backup, matching your wallet with our server, payments and restores won't work. Google Analytics and Meta ad measurement on the site can be turned off in Your Privacy Choices.

Cookies, on-device storage and SDKs

Our site (buddies.bang9.dev) remembers your language and privacy choice, and uses cookies and browser storage for site statistics, visit analysis and ad measurement. Legal and help pages don't run any analytics.

Tools

Consent and how to turn things off

• EEA, UK and Switzerland (and when we can't tell your country): the site shows a consent prompt the first time you open it. Until you choose "Allow", we run none of site statistics, Google Analytics or ad measurement. You can change your choice or withdraw consent at any time in Your Privacy Choices; if you withdraw, we stop all three and delete the analytics ID, visitor cookies and ad cookies stored on your device.
• Other countries: we run site statistics, Google Analytics and ad measurement. Google Analytics and ad measurement stop if you choose "Don't allow" in Your Privacy Choices or turn on GPC in your browser. In Korea, this sending of data is treated as outsourcing and disclosed in this policy, without separate consent.
• Third parties, including Meta, may use cookies, web beacons and similar technologies to collect or receive information from this site and elsewhere on the internet, and use it to measure ads and choose targeted ads. To opt out of this use for targeted ads, use Meta's ad settings, the DAA (US) or the EDAA (Europe).
• The app's analytics: there is no switch in the app for now. To object to this processing, let us know at Privacy contact. Deleting the app and its storage folder (see 'Data kept only on your device') also removes the device analytics ID.
• RevenueCat: needed to confirm purchases, so it can't be turned off separately. To stop it, uninstall the app.
• Site language memory and privacy choice: clear the site data in your browser.

External Transmission Disclosure (Japan)

Under Article 27-12 of Japan's Telecommunications Business Act, we disclose the information TTANG TTANG Buddies and our site (buddies.bang9.dev) send from your device to other companies. Save backups and analytics sent to our own server (Cloudflare) are received by us, so they aren't included here; they are in "Cookies, on-device storage and SDKs" above.

Children's data

This app is not directed at children under 13 (under 14 in Korea; in the EEA, under the age at which you can consent to data processing on your own in your country — 13–16 depending on the country). The app doesn't ask your age, doesn't collect names or contact details, and has no way to talk with other people. If we learn that we have collected personal data from someone younger than this, we delete it. Parents and guardians can ask to see or delete data at Privacy contact.

Your rights and how to use them

You can ask at any time to see, correct or delete your personal data, or to stop processing it. Where the law provides, you can also ask for a copy to take elsewhere (portability) and object to processing.

• Stop key counting: turn off TTANG TTANG Buddies in System Settings → Privacy & Security → Input Monitoring. Petting, tossing and dressing up still work.
• Erase data on your device: delete the app and the app storage folder that stays on your Mac (~/Library/Containers/dev.bang9.ttangpet).
• See or delete your save backup or payment records, or download your save backup: email Privacy contact.
• Turn off ad measurement on the site or withdraw consent: choose "Don't allow" in Your Privacy Choices.

We reply within 10 days as required by the Korean Personal Information Protection Act and, if we need longer, tell you why and when to expect a reply. To confirm it's you, we may ask you to verify a receipt. You can also make a request through a legal representative or someone you authorize.

Your Privacy Choices

If you live in California or certain other US states, you can opt out of the sale or sharing of your personal information as described below. Visitors in the EEA, UK and Switzerland can change or withdraw their site consent in the same place.

Do Not Sell or Share My Personal Information

We don't sell personal information. Meta ad measurement on our site (sending pages viewed and site events to Meta) may count as "sharing" under some US state laws. To opt out:

1. On this site: press "Don't allow" in the choice box below. Ad measurement and Google Analytics won't be turned on in that browser, and the cookies those two tools already set are deleted. Each browser has its own choice.
2. By email: send "Do Not Sell or Share" to Privacy contact. We'll process it within 15 business days.

The app doesn't sell or share personal information.

Global Privacy Control (GPC)

The site treats a GPC signal from your browser as an opt-out of sale and sharing, so Google Analytics and Meta ad measurement aren't turned on in that browser (site statistics continue). When that happens, the choice box below shows that ad measurement is off because of GPC.

Appeals

If we deny your request or you're not satisfied with our answer, send "Appeal" to Privacy contact. We'll review it again within 45 days and tell you the result and the reasons. If it's still not resolved, you can contact the Attorney General of your state.

How we keep data safe

• All communication with our server is encrypted.
• The app only receives when and how many times keys are pressed, so it neither reads nor changes what you type.
• Payment notices are checked against forgery to block fake payments.
• Only we can access the server and provider dashboards, and passwords and keys are stored encrypted.

Where to get help

If you need help with a privacy problem in Korea, you can contact:

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
• Korean National Police Agency, Cyber Bureau: 182 (ecrm.police.go.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)

Users in other countries can complain to the authorities listed in the country sections below.

Changes to this policy

This policy (version 8) was announced on October 17, 2026 and takes effect on October 24, 2026. If we change this policy, we'll announce it on this page before the change takes effect (on the effective date at the latest) and show what changed side by side with the previous version. If a new purpose or a new recipient is added, we'll tell you before that processing starts and ask for your consent where the law requires it.

What changed in version 8: we stopped selling the web edition, so we removed the data used for web edition payments and license key checks and its recipient (Dodo Payments). The other data, purposes, recipients, retention periods and your rights are the same as in version 7.

Previous versions: Version 7 (October 17, 2026 – October 23, 2026), Version 6 (October 9, 2026 – October 16, 2026), Version 5 (October 6, 2026 – October 8, 2026), Version 4 (October 5, 2026 – October 5, 2026), Version 3 (October 4, 2026 – October 4, 2026), Version 2 (October 4, 2026 – October 4, 2026), Version 1 (October 3, 2026 – October 3, 2026)

Language

This document was originally written in Korean. Translations are provided for convenience. If they differ, the original prevails, unless the law of the country where you live says otherwise.

EEA, UK and Switzerland

• The controller is us (see "Privacy contact" above).
• The legal bases are in the purposes table above: performance of a contract (GDPR 6(1)(b)), legitimate interests (6(1)(f)), and consent for site statistics and ad measurement (6(1)(a)). You can withdraw consent at any time in Your Privacy Choices; processing before you withdraw stays lawful.
• You can object at any time to processing based on legitimate interests (our statistics, server security) (GDPR Art. 21), and we will stop unless we have compelling grounds.
• Your rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21).
• Complaints: you can complain to the data protection authority in your country (ICO in the UK, FDPIC in Switzerland). If a UK user sends us a complaint, we will acknowledge it within 30 days as required by the UK Data (Use and Access) Act 2025.
• We don't make automated decisions or do profiling that has legal effects.
• Device storage: the app keeps your progress save and a device analytics ID on your device, and the site stores values for statistics, analysis and ad measurement only after you choose "Allow" (ePrivacy Directive Art. 5(3), UK PECR reg. 6).
• International transfers: see the transfers table above.

Switzerland

Under the Swiss Federal Act on Data Protection you can ask for access, correction, deletion and portability, and complain to the Federal Data Protection and Information Commissioner (FDPIC). Transfers to US providers are protected by the Swiss-US Data Privacy Framework or standard contractual clauses.

United States (California and other state laws)

• Categories collected in the past 12 months: identifiers (device and browser analytics IDs, buyer identifier, ad cookies, IP address), commercial information (purchase records), internet activity (app and site events, pages viewed), approximate location from IP (country). We don't collect sensitive personal information.
• Sources, purposes, recipients and retention are as in the tables above.
• Sale and sharing: we don't sell personal information. Meta ad measurement on our site may count as "sharing" for targeted advertising, and you can opt out in Your Privacy Choices. The categories shared are identifiers (ad cookies, IP address) and internet activity (pages viewed, site events), and the recipient is Meta.
• Your rights: to know, delete and correct. We won't discriminate against you for using them. You can use an authorized agent, and we may ask to verify your identity. To appeal a denial, see "Appeals" in Your Privacy Choices.
• Do Not Track: we don't respond to browser DNT signals separately, but we treat GPC signals as an opt-out of sale and sharing.
• If anything changes, we'll update this policy and its effective date.

Other countries

Users in the countries below can use the rights their country's law gives them. Send requests and complaints to Privacy contact. Purposes and legal bases are in the purposes table above, and personal data goes outside those countries as shown in the international transfers table above.

• Japan: the business handling personal information is winterlog studio (owner Hyungu Kang; address in the privacy contact above), and security measures are in "How we keep data safe" above. Foreign systems: Korea, where we are based, has the Personal Information Protection Act; the US, where our providers are, has no comprehensive federal privacy law but has state laws such as the California Consumer Privacy Act. We have set security measures with our providers through their data processing terms.
• Brazil: the controller (controlador) is winterlog studio and the data protection officer (encarregado) is Hyungu Kang (Privacy contact). Legal bases (LGPD Art. 7) are performance of a contract (V) and legitimate interest (IX); site statistics and ad measurement are also based on legitimate interest, and you can turn ad measurement off in Your Privacy Choices. International transfers: Transferência internacional de dados pessoais.
• Mexico: the responsible party (responsable) is winterlog studio (address in the privacy contact above). Primary purposes are providing the pet app, save backup and purchase checks; the secondary purpose is our own statistics.
• Canada and India: our privacy officer (in India, grievance officer) is the owner, Hyungu Kang (Privacy contact).

International Transfers of Personal Data (Brazil)

Personal data of users in Brazil is transferred outside Brazil as shown below.

• Recipients: us (winterlog studio, Korea) and the US providers in the table.
• Mechanism and legal basis: transfers needed to perform the contract (LGPD Art. 33 IX), providers' data processing terms and standard contractual clauses (Art. 33 II).
• Purposes and periods: see the purposes table and the retention table in the Privacy Policy.
• Responsibility: we are responsible for protecting the transferred data.
• Rights: you have the same LGPD Art. 18 rights; send requests to support@bang9.dev.
• Onward transfers: providers may pass data to their own sub-processors, and we require the same level of protection by contract.