This Privacy Policy explains what personal data KenesLab ("we", "us" or "our") collects when you use TR1 (the "Service"), why we collect it, how long we keep it, who we share it with, and what rights you have. It is written to meet the requirements of the EU and UK General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"). Terms not defined here have the meaning given in our Terms of Service.
1. Who we are
The controller of your personal data is KenesLab, a sole proprietorship established in the Republic of Korea.
| Controller | KenesLab |
|---|---|
| Address | #601, Bldg. 1 (Gold Terrace), 336 Ancheong-ro, Cheongbuk-eup, Pyeongtaek-si, Gyeonggi-do, Republic of Korea |
| kraplo.x1@gmail.com |
Section 14 explains how to contact us about privacy.
2. Personal data we collect
We collect only the data we need to run the Service. The data we collect depends on whether you play as a Member (with an Account) or as a Guest.
2.1 Account data (Members)
- Email address — used as your login identifier and to contact you about your Account.
- Password — if you register with email, we store only a one-way cryptographic hash of your password, never the password itself.
- Nickname — assigned automatically when you register; you can change it.
- Email verification data — when you register, add an email login, or reset your password, we temporarily store the email address you entered, a verification code and its expiry time until you complete the process or the code expires.
2.2 Google sign-in
If you choose to sign in with Google and allow Google to share your information with us, we receive from Google: a unique identifier for your Google account, your email address, and whether Google has verified that email address. We do not receive or store your Google profile name or photo, and we do not access any other data in your Google account (such as contacts, calendar or files). If you use only Google sign-in, we do not store a password for you. You may later add an email and password login in My Page.
2.3 Guest data
If you play as a Guest, we do not collect an email address or password. We process:
- a random identifier stored in a cookie in your browser and the matching identifier on our servers (this identifier does not by itself reveal who you are);
- a nickname assigned automatically (Guests cannot change it); and
- the game and technical data described in Sections 2.4 and 2.6.
Because guest data is linked only to that cookie, if you clear your cookies or use another browser or device, we cannot link the data back to you and cannot help you recover it. If you later register or sign in to an Account, we will ask whether you want to link your guest game data to that Account, and we link it only if you choose to.
2.4 Game data
Data generated as you play, such as your Characters and their names, levels, progress, items, in-game currency, achievements and in-game activity records (for example, battles, crafting and trades within the game).
2.5 Content and communications
- Community posts you write (Members only), and reports you submit about other posts.
- 1:1 Support inquiries (Members only), including their title, text and any images you attach, and our replies.
- In-game mail we send you, such as notices, rewards and replies.
2.6 Technical and security data
- IP address — used to block abnormal access, to limit repeated login and verification attempts, and to protect the Service from excessive requests.
- Browser information (user agent) and error records — recorded together with the IP address when an error occurs, so that we can diagnose problems.
- Access and session records — the time you access the Service, your last login time, and the login sessions active on your Account.
2.7 Account records
- Nickname change history — the previous and new nickname and the time of each change, used to resolve disputes about names and to prevent abuse.
- Consent records — when you agree to our Terms of Service and this Privacy Policy, we record the time, the effective date of the version you agreed to, and the sign-up route (email, Google or guest). We do not record your IP address for this purpose.
- Sanction history — any warnings or suspensions applied to your Account under the Code of Conduct, with their reason and duration.
2.8 Data collected by Google for analytics and advertising
Our website uses Google Analytics and Google AdSense, which collect information directly from your browser through cookies and similar technologies, such as online identifiers, the pages you visit, your interactions with the site, device and browser information, and approximate location derived from your IP address. We also advertise the Service with Google Ads. To measure how well those ads work, we send Google Analytics a small number of in-game milestones (starting as a Guest, creating a Character, reaching certain levels, signing up, and completing a purchase with its amount, currency, item and our order number), and Google may connect them with an ad you clicked (conversion measurement). These milestones do not include your email address, nickname or payment details. See Section 5.
2.9 Payment data
If you make a purchase (Members only), payment is handled by PayPal on PayPal's website. We do not receive or store your card or bank account details. We keep a record of each order: our order number, the PayPal order and payment (capture) identifiers, the item purchased, the amount and currency, the order status (for example, completed, refunded or reversed), the relevant times, the time you gave consent to immediate delivery, your IP address when you started the purchase, the country (and, where PayPal provides it, the state or region) of your PayPal account, and the PayPal fee charged to us. We use your country to check whether purchases are available where you are (they are currently not available in the European Union or the United Kingdom; if your PayPal account is registered there, we stop the purchase before you are charged) and to apply the correct sales tax, and we keep your IP address as supporting evidence of your location for tax purposes. We also keep a record of which purchased items and currency you have used, so that we can handle refund requests. PayPal collects and processes your payment information (such as your PayPal account, name, billing details and payment method) as an independent controller under its own privacy statement.
2.10 What we do not collect
We do not ask for your real name, date of birth, phone number, postal address, government identification number or precise location. We do not intentionally collect special categories of personal data (such as health data or data about racial or ethnic origin). Please do not include such information in community posts or support inquiries.
3. How and why we use your data
The table below lists the purposes for which we use personal data and, for users in the EEA and UK, the legal basis under Article 6(1) of the GDPR.
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Creating and managing your Account or guest profile, signing you in, and keeping your session active | Account data, Google sign-in data, guest identifier, session records | Performance of a contract (Art. 6(1)(b)) |
| Providing the game and saving and restoring your game data | Game data, nickname, Character names | Performance of a contract (Art. 6(1)(b)) |
| Sending verification codes, password reset codes and service messages | Email address | Performance of a contract (Art. 6(1)(b)) |
| Answering support inquiries and handling complaints and appeals | Inquiries and attachments, Account and game data relevant to the inquiry | Performance of a contract (Art. 6(1)(b)); legitimate interests in resolving issues (Art. 6(1)(f)) |
| Operating the community, including reports and moderation | Community posts, reports, nickname | Performance of a contract (Art. 6(1)(b)); legitimate interests in a safe community (Art. 6(1)(f)) |
| Security, preventing fraud, cheating and abuse, rate limiting, and diagnosing errors | IP address, user agent, error records, access and activity records | Legitimate interests in protecting the Service and its players (Art. 6(1)(f)) |
| Enforcing our Terms and Code of Conduct, including sanctions and name changes | Activity records, sanction history, nickname change history, content | Performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Keeping evidence of your agreement to our Terms and Privacy Policy | Consent records | Legitimate interests in being able to demonstrate agreement (Art. 6(1)(f)); legal obligation where applicable (Art. 6(1)(c)) |
| Measuring how the website is used and improving the Service (Google Analytics) | Analytics cookies and related data | Consent where required by law (Art. 6(1)(a)); otherwise legitimate interests (Art. 6(1)(f)) |
| Showing advertising (Google AdSense) | Advertising cookies and related data | Consent where required by law (Art. 6(1)(a)); otherwise legitimate interests (Art. 6(1)(f)) |
| Processing purchases, delivering purchased items, and handling refunds, payment reversals and billing questions | Order and payment records, record of purchased items used, Account identifier | Performance of a contract (Art. 6(1)(b)) |
| Preventing payment fraud and handling chargebacks | Order and payment records, activity records | Legitimate interests in protecting the Service against fraud (Art. 6(1)(f)) |
| Checking whether purchases are available in your country, and complying with legal obligations, such as determining where you are located for tax purposes, keeping accounting and tax records of payments, and responding to lawful requests from authorities | Order and payment records (including your country and the IP address used for the purchase); other relevant records | Legal obligation (Art. 6(1)(c)); for checking availability, our legitimate interest in selling only where we are able to meet local tax requirements (Art. 6(1)(f)) |
Where we rely on legitimate interests, you have the right to object (see Section 10). We do not use your personal data for purposes that are incompatible with those listed above.
Automated processing. Some community safeguards are automatic: banned words in posts and names are masked or rejected, and a post reported by several different players may be temporarily hidden until a staff member reviews it. Sanctions against Accounts are decided by a person. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
If you do not provide data. An email address (or a Google account) is required to register an Account. You can use part of the Service as a Guest without providing one.
4. Where the data comes from
- From you, when you register, play, post, report or contact us.
- From Google, if you choose to sign in with Google (see Section 2.2).
- From PayPal, when you make a purchase: the order and payment identifiers, the status of the payment, the country (and state or region, if available) of your PayPal account, and the PayPal fee (see Section 2.9).
- Automatically, from your browser and device when you use the Service (see Sections 2.6 and 5).
5. Cookies and similar technologies
We use cookies and similar technologies (such as your browser's local storage) for the purposes below. Cookie names used by the Service begin with tr1_.
| Type | Purpose | Duration |
|---|---|---|
Login session (tr1_auth) — strictly necessary | Keeps you signed in. Not used for advertising or tracking. | Up to 30 days; sessions end sooner after a period of inactivity |
Guest identifier (tr1_guest) — strictly necessary | Links your browser to your guest game data. For Guests, this cookie is the only way to identify your data. | 30 days, renewed on each visit |
Sign-in security cookies (tr1_oauth and related) — strictly necessary | Protect the Google sign-in and sign-up process against forgery. | About 10 minutes |
Cookie choice (tr1_consent) — strictly necessary | Remembers whether you accepted or rejected analytics and advertising cookies, so we do not ask again on every page. | 6 months |
Language preference (tr1_lang) — functional | Remembers the language you selected. | Persistent until you clear it |
| Local and session storage — functional | Stores display preferences and a per-window identifier used to keep only one game window active. | Until you clear it or close the window |
Google Analytics (for example _ga, _ga_*) — analytics | Helps us understand how visitors use the website, using aggregated statistics. | Up to 2 years |
Google AdSense (for example __gads, __gpi, and cookies on Google advertising domains) — advertising | Lets Google show ads, limit how often you see an ad, measure ad performance and, where permitted, personalize ads based on your activity across websites. | Set by Google; typically up to 13 months or longer |
Google Ads conversion measurement (for example _gcl_au, _gcl_aw) — advertising | Remembers that you arrived from one of our Google ads, so that Google can tell us which ads led to sign-ups or purchases. | Up to 90 days |
Your choices.
- EEA, UK and Switzerland — cookie banner. If you are in the European Economic Area, the United Kingdom or Switzerland, on your first visit we show a banner where you can Accept all, Reject all or Customize (turn analytics and advertising on or off separately). Until you choose, and whenever you reject, analytics and advertising cookies are off: we use Google Consent Mode, so Google's tags do not set or read Google Analytics or advertising cookies, and only non-personalized ads are shown. In that state Google may still receive limited cookieless requests (for example, to count a page view or to serve a non-personalized ad), which include technical information such as your IP address and browser details. You can change or withdraw your choice at any time using the Cookie settings link at the bottom of the page. We work out whether this applies to you from your browser's time zone and, as a second check, Google works it out from your IP address; if either indicates one of these regions, the cookies stay off until you accept.
- Elsewhere, including the United States — opt out. Analytics and advertising cookies are on by default, and we do not show a banner. You can turn them off at any time using the Do Not Sell or Share My Personal Information or Cookie settings link at the bottom of the page (see Section 10.2). If your browser sends a Global Privacy Control signal, we treat it as a request to opt out and turn advertising cookies off automatically.
- You can block or delete cookies in your browser settings. If you block the strictly necessary cookies, you will not be able to sign in or play as a Guest, and deleting the guest cookie means losing access to your guest data.
- You can turn off personalized advertising from Google in Google's My Ad Center (ad settings), and learn how Google uses data at policies.google.com/technologies/partner-sites.
- You can prevent Google Analytics from collecting your data by installing the Google Analytics opt-out browser add-on.
- You can also opt out of interest-based advertising by participating companies at youronlinechoices.eu (EEA/UK) or optout.aboutads.info (US).
Where the law of your country requires consent for analytics or advertising cookies, we rely on your consent for them, and you can withdraw it at any time using Cookie settings, the other options above, or by contacting us.
6. Who we share your data with
We do not sell your personal data for money. We share personal data only as described below.
6.1 Service providers (processors)
| Provider | Service | Location |
|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, databases, file and log storage; image delivery (Amazon CloudFront); sending emails such as verification codes (Amazon SES) | United States (US West – Oregon region); CloudFront delivers content from edge locations worldwide |
| Google LLC / Google Ireland Limited | Website analytics (Google Analytics) | United States and other countries where Google operates |
These providers process personal data on our behalf and under our instructions, under data processing terms that require them to protect it.
6.2 Independent third parties
- Google sign-in. If you sign in with Google, Google processes your Google account data under its own privacy policy.
- PayPal. When you make a purchase, you are redirected to PayPal, which processes your payment and payment information as an independent controller under its own privacy statement. We send PayPal the order details (item, amount and currency) and, for refunds, the payment identifier. PayPal may process data in the United States and other countries.
- Google AdSense and Google Ads. Google uses cookies and other data to deliver and measure ads (including measuring our own Google Ads campaigns) and, where permitted, to personalize them. For these purposes Google acts as an independent controller under its own privacy policy.
6.3 Other disclosures
- Where required by law, court order or a lawful request from a public authority, or where necessary to protect the rights, safety or property of our players, the public or us.
- To a successor organization if the Service is transferred, subject to this Privacy Policy.
- With your consent or at your direction.
Other players can see your nickname, Character names and community posts, and some game information (such as rankings) as part of the game.
7. International transfers
We are based in the Republic of Korea, and our servers are hosted by Amazon Web Services in the United States. Your personal data will therefore be transferred to, stored in and accessed from the United States and the Republic of Korea, and may be processed in other countries where our service providers operate.
- Transfers to the Republic of Korea from the EEA and the UK are covered by adequacy decisions of the European Commission (2021) and the UK Government (2022).
- Transfers to the United States are made to providers that participate in the EU-U.S. Data Privacy Framework (and its UK Extension) or, where that does not apply, under the European Commission's Standard Contractual Clauses (and the UK Addendum) included in those providers' data processing terms.
You can ask us for more information about these safeguards by contacting us as described in Section 14.
8. How long we keep your data
| Data | Retention |
|---|---|
| Account data, game data, nickname change history, consent records, sanction history, community posts and support inquiries (including attachments) | Until your Account is deleted (by you or by us). You can delete individual community posts earlier. Attachment files are removed by a daily cleanup process after the inquiry is deleted. |
| Guest data | 30 days after your last visit, then deleted automatically without notice. Each visit restarts the period. |
| Email verification codes | Until the process is completed or the code expires (10 minutes), whichever is earlier |
| Pending Google sign-up data (while you review our Terms before your Account is created) | About 10 minutes, and deleted shortly afterwards if you do not complete sign-up |
| Login sessions | Until you sign out or the session expires |
| Login and verification attempt counters (IP address or email address) | For the duration of the rate-limiting window (up to 24 hours) |
| Server error logs (including IP address and browser information) | 30 days on our application servers, after which they are moved to archive storage and deleted 1 year after they were recorded |
| In-game activity records | 7 days in our database, after which they are moved to compressed archive storage for security, fraud prevention and dispute resolution, and deleted about 1 year after they were recorded. Archived records are linked to an internal account number, not to your email address or nickname. |
| Records of actions taken by our staff concerning your Account (for example, sanctions) | 3 years, for accountability and dispute resolution |
| A minimal record that an Account was deleted (without email address or nickname) | 3 years |
| Email addresses that have bounced or reported our emails as spam | Kept on a suppression list for as long as needed to avoid sending further email to them |
| Order and payment records | 5 years from the transaction, for accounting and tax purposes. If you delete your Account, these records are kept for the rest of that period but are detached from your Account (the link to your Account is removed), so that they are no longer associated with your email address, nickname or game data. The PayPal transaction identifiers in these records remain, because they are needed to reconcile our accounts with PayPal. |
When the retention period ends, we delete the data or make it anonymous. Data held in backups is overwritten in the normal backup cycle.
9. Deleting your Account
9.1 You can delete your Account at any time from the Support section of My Page. Guests can delete their guest data in the same place. Deletion takes effect immediately, with no grace period: your Account and the Characters, game data, community posts and support inquiries linked to it are deleted and cannot be recovered.
9.2 The limited records described in Section 8 (archived logs, staff action records, a minimal deletion record and order and payment records detached from your Account) are kept for the periods stated there. Unused purchased items are lost when your Account is deleted; if you want a refund, please request it before deleting your Account (see Section 8 of the Terms of Service).
9.3 If you signed in with Google, deleting your Account also deletes the link we hold. The connection record on Google's side can only be removed by you, in your Google account's security settings (third-party connections).
9.4 Self-service deletion is not available while your Account is suspended. During a suspension you can still request deletion through 1:1 Support, and we will handle the request under Section 10.
10. Your rights
10.1 Rights under the GDPR (EEA and UK)
If you are in the EEA or the UK, you have the right to:
- access your personal data and receive a copy of it;
- rectify inaccurate or incomplete data;
- erase your data ("right to be forgotten");
- restrict our processing of your data;
- data portability — receive the data you provided to us in a structured, commonly used, machine-readable format and have it transmitted to another controller;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- withdraw consent at any time, where we rely on consent, without affecting processing carried out before withdrawal; and
- lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where an alleged infringement took place. In the UK, this is the Information Commissioner's Office (ico.org.uk).
10.2 Rights under the CCPA (California)
To the extent the CCPA applies to us, California residents have the right to:
- know what personal information we collect, use and disclose, and to access it;
- delete personal information we have collected from them;
- correct inaccurate personal information;
- opt out of the sale or sharing of personal information; and
- not be discriminated against for exercising these rights.
In the past 12 months we have collected the following categories of personal information, for the purposes described in Section 3 and from the sources described in Section 4: identifiers (email address, Google account identifier, IP address, cookie and online identifiers, nickname); internet or other electronic network activity (game activity, access records, error records, website usage collected by Google Analytics and AdSense, and the in-game milestones described in Section 2.8); commercial information (records of items purchased, amounts and payment status); and account login credentials (email and password), which are "sensitive personal information" that we use only to authenticate you. We disclose these categories to the service providers listed in Section 6.1 for business purposes. We do not use sensitive personal information to infer characteristics about you.
Sale and sharing. We do not sell personal information for money, and we do not have actual knowledge that we sell or share the personal information of consumers under 16. However, Google AdSense on our website uses cookies and similar technologies to show ads, which may include personalizing ads based on your activity across websites, and we let Google measure our own Google Ads campaigns using identifiers and the in-game milestones described in Section 2.8. This may be considered "selling" or "sharing" of personal information for cross-context behavioral advertising under the CCPA. In the past 12 months we have made identifiers and internet or other electronic network activity available to Google for these purposes. To opt out:
- use the Do Not Sell or Share My Personal Information link at the bottom of the page. This turns off advertising cookies and ad measurement in that browser (it is stored in the
tr1_consentcookie, so you need to do it again in each browser or after clearing cookies); - turn on Global Privacy Control in your browser — we treat it as an opt-out request;
- turn off personalized ads in Google's My Ad Center, and/or use optout.aboutads.info;
- block third-party cookies in your browser; and/or
- send us an opt-out request as described in Section 10.3. Because these advertising cookies are set by Google in your browser rather than stored on our servers, we will reply explaining how the opt-out is applied to your browser.
You may use an authorized agent to make a request on your behalf. We may ask the agent for proof of authorization and may ask you to confirm the request.
10.3 How to exercise your rights
- View and correct: you can see your email address and nickname, and change your nickname, in My Page.
- Delete: you can delete your Account or guest data yourself at any time from the Support section of My Page (see Section 9).
- All other requests — including access, a copy of your data, data portability, restriction, objection and opt-out — can be made through 1:1 Support in My Page, or by email to kraplo.x1@gmail.com. We do not yet offer a self-service data export; we will prepare your data and provide it to you in a commonly used, machine-readable format.
A request made through 1:1 Support while you are signed in is treated as coming from the Account holder. For requests made by other means, we may need to verify your identity, for example by asking you to confirm control of the email address on the Account. 1:1 Support is not available to Guests. Guests can make requests by email; because guest data is linked only to a browser cookie, we may be unable to identify guest data without information from that browser.
We will respond within one month of receiving your request (GDPR) or within 45 days (CCPA). We may extend this period where the law allows, for example for complex requests, and will tell you if we do. We do not charge a fee unless a request is manifestly unfounded or excessive.
11. Security
We use technical and organizational measures designed to protect personal data, including:
- storing passwords only as one-way cryptographic hashes, so that we cannot know your password;
- using randomly generated session tokens with expiry times, and ending sessions on all devices when you change your password;
- signing you out automatically after a period of inactivity;
- verifying anti-forgery (CSRF) tokens on requests that change data;
- storing support attachments outside the public web directory and serving them only to their owner and our staff; and
- limiting access to personal data to the people who need it to operate the Service, and logging staff actions.
No method of transmission or storage is completely secure. If a personal data breach occurs that is likely to put your rights at risk, we will notify you and the relevant authorities as required by law.
12. Children
The Service is not directed to children under 13, and we do not knowingly collect personal data from children under 13. Users in the EEA and the UK must be at least 16. We do not currently verify users' ages. If we learn that we hold personal data of a person below these ages, we will delete the relevant Account or guest data and associated data. If you are a parent or guardian and believe that your child has provided us with personal data, please contact us as described in Section 14.
13. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in the Service or the law. We will announce changes in the Service at least 7 days before they take effect, or at least 30 days before if the change significantly affects your rights, and will notify Members by email of significant changes. Where the law requires your consent to a change, we will ask for it.
14. Contact
If you have any question or complaint about this Privacy Policy or how we handle your personal data, please contact us through 1:1 Support in My Page or by email at kraplo.x1@gmail.com, or by post to KenesLab, #601, Bldg. 1 (Gold Terrace), 336 Ancheong-ro, Cheongbuk-eup, Pyeongtaek-si, Gyeonggi-do, Republic of Korea. We will respond without undue delay.
This Privacy Policy takes effect on 2026-09-29.