Privacy Policy
Killer Chat Privacy Policy
Effective date: 2026-10-19 · English version of the Korean policy (effective 2026-10-13 · first effective 2026-08-20 · corrected 2026-09-07 and 2026-10-01)
The official version is in Korean — 개인정보처리방침(한국어)
Killer Chat (Korean name 〈킬러들의 단톡〉, Japanese name 〈即死チャット〉; the "Service") is operated by Making Soul Studio (메이킹소울스튜디오, "we", "us"), a business registered in the Republic of Korea. We take your privacy seriously and comply with Korea's Personal Information Protection Act and, where they apply to you, other data protection laws such as the EU and UK General Data Protection Regulation (GDPR). This policy explains what information the Service collects, what we use it for, and how long we keep it. It describes the same practices as the Korean policy, which is the official version.
1. Information we collect
We do not ask for your name, date of birth, phone number, or postal address when you sign up. We collect the following.
(1) Information you enter
| Item | Details | Required? |
|---|---|---|
| Nickname | 1–8 characters, shown to other users. You can set a different one in each room. When you change it in a room, we record the old and new nickname (used for the one-minute limit on changing it again and for handling @tags that used the old name) | Required |
| Chat messages | What you type in a game room (up to 500 characters at a time). We also record who you tagged with @ and which message you replied to | Required |
| Photos | Photos you send in a game room (picked from your album or taken with the camera). They are resized on your device before sending, which removes the location and device information (EXIF). They are shown to members of the same room | Optional |
| Reports | Who you reported and why (spam / abuse or harassment / sexual content / other) | Optional |
| Block list | Users you blocked | Optional |
| Kick list | Participants removed by the room host (to stop them rejoining that room) | Automatic |
(2) Account information
- Guest play: you only get an anonymous identifier. No other information is needed.
- Linking a Google account (optional): to keep your progress when you change devices, we receive the email address and account identifier of your Google account. You can use every feature without linking.
- Sign in with Apple (optional, iOS): for the same purpose, we receive the account identifier provided by Apple and, if you choose to share it, your email address (including Apple's private relay address). Apple's sign-in screen may ask whether to share your name, but our servers do not receive or store your name. To disconnect from Apple when you delete your account, we keep the connection token (refresh token) issued by Apple on our server.
(3) Information generated automatically when you use the Service
| Item | Details |
|---|---|
| Game records | Rooms you joined, kill and death records (display names of the killer and the player who died, the word used, time), daily rankings, room notices (join, nickname change and Kill King notices — these contain nicknames as text) |
| Read position | How far you have read in each room (message number). It is recorded on the server when you enter a room, while you are viewing a room, and when you send a message, and it is shown to members of the same room as the "number of people who haven't read yet" next to each message |
| Push notification token | A device token used to deliver notifications. It is registered after you sign in, and it may be created and kept even if you turned off notifications on your device |
| Rewarded ad records | Records of rewards given for ads (reward identifier, time) — to prevent duplicate rewards and abuse |
| Lifetime stats and achievement progress | Totals such as kills, deaths, deaths by saying your own name, games played, first places and games without dying; daily game records (whether you chatted that day, whether you chatted late at night (0:00–6:00), and that day's kills and deaths — used for the "days played" and "days survived" achievements); number of chats you sent and chats sent in a row without dying; days you opened the app; number of ads watched and Instant Revives used, and when you first reached each milestone; kinds of words you used to get kills; the account identifiers of players you killed (to count how many different players). Equipped titles and name tags (achievement rewards) are shown to members of the same room |
| Items you own | Skins, avatars, Instant Revives and Hint Tickets (quantities), and stickers (including when you got them) that you bought or received |
| Purchase, grant and refund records | For paid items: purchase token, product identifier, purchasing account identifier, time of grant and revocation, items and quantities granted, and quantities used. We never receive card numbers or bank account numbers |
| Event records | Your event number (a 6-digit number, one per account — you show it yourself when you take part in an event) and records of event gifts (order number, time given, whether you checked it). We do not store your accounts on outside services used to take part (such as Threads) |
| Crash and diagnostic records | Errors and stack traces in the release app, the app state when an error happened, device model, OS, app version, and installation and session identifiers (Firebase Crashlytics) |
| Firebase installation ID | An app installation identifier created and processed by the Firebase SDK for push delivery and error diagnosis |
(4) Information processed to show ads
The Service shows rewarded ads through Google AdMob. The ad SDK collects your IP address and the approximate location derived from it, interactions such as app launches, taps and video views, app and SDK performance diagnostics, and device and account identifiers such as the advertising ID (AAID) and app set ID (the iOS app does not ask for tracking permission, so it does not receive the advertising identifier (IDFA)), and shares them with Google to provide ads, for analytics and to prevent fraud. The Service has no feature that asks for your precise GPS location.
To give an ad reward to your account, we pass your Service account identifier to AdMob, and our server receives a reward verification result signed by Google. The app initializes the ad SDK when it first requests a rewarded ad. You can reset or delete your advertising ID in your Android settings, but this alone does not stop all the other processing above. For details, see AdMob's data disclosure (Android · iOS) and the Google Privacy Policy.
(5) Information processed to measure ad performance (Android app)
When we run app install ads on Meta (Facebook and Instagram), we measure how well they work with the Meta SDK in the Android app. The SDK turns on only if you choose to agree to "Share info for ad performance measurement" (you can choose on the first screen of the app or in your profile, and you can use every feature without agreeing). Once on, it sends the advertising ID (AAID), an app installation identifier created by the Meta SDK, device information such as model, screen size, OS and app version, carrier, language, time zone and IP address, and events for app installs, app launches, time spent in the app and Google Play in-app purchases (product, price and currency) to Meta Platforms, Inc. If you allow ad topics on your device (Topics in the Android Privacy Sandbox), the result may also be used. We do not send your nickname, chats, email or other Service account information, and the iOS app does not include the Meta SDK.
Meta uses this information to tell whether people who saw an ad installed the app and to optimize ad delivery, and under Meta's privacy policy it may also use it for its own advertising services. You can withdraw your consent at any time with "Share info for ad performance measurement" in your profile. When you withdraw, the app restarts right away, stops sending to Meta from then on, and deletes the measurement records left on the device without sending them (records that were already being sent just before you withdrew may still be sent). You can reset or delete your advertising ID in your Android settings, and if you have a Facebook or Instagram account you can disconnect the activity this app sent from your account under "Your activity off Meta technologies" in Accounts Center. For details, see the Meta Privacy Policy and the Meta Business Tools Terms.
2. How we use information
- Running games, deciding results and calculating rankings
- Providing chat (showing members of the same room how many people haven't read each message yet, tags and replies)
- Showing your lifetime stats and managing achievement progress
- Identifying you and keeping your records (when you link an account)
- Handling reports, preventing abuse such as offensive language or spamming, and taking action against it
- Preparing and sending push notifications (whether your device shows them depends on your device settings)
- Verifying rewarded ads, verifying paid purchases, granting and restoring items, revoking refunded items and preventing duplicate grants
- Giving event gifts (checking event numbers and preventing duplicate gifts)
- Diagnosing app errors and improving stability (Firebase Crashlytics)
- Measuring the performance of app install ads and optimizing ads (Android app, Meta — only if you agreed)
- Analysis to improve the Service and balance the game
Analysis is done in two ways.
- Counting how often words are used — we extract only the words from chats and count them. Who said them and when is not kept, so no individual can be identified.
- Reading chats — to handle reports and improve the Service (finding what is inconvenient or fun), the operator may read chats directly (including photos sent). Only the operator personally reads them, only chats within the 30-day retention period, and what is read is never provided to anyone else or made public. Chats older than 30 days are deleted automatically and cannot be read.
Legal bases (users in the EEA and the UK)
- Performance of our contract with you: running games and chat, your account and records, achievements, items, purchases, restoring and revoking items, event gifts and push notifications.
- Our legitimate interests: keeping the Service safe and fair (reports, abuse prevention, moderation, and reading chats within 30 days for reports and improvement as described above), error diagnosis, word statistics and game balance, and showing rewarded ads that you choose to watch to fund the free Service.
- Your consent: ad performance measurement with the Meta SDK in the Android app (section 1(5)). You can withdraw it at any time; this does not affect processing before you withdrew.
- Legal obligations: when a law requires us to keep or provide information.
3. Retention and deletion
Our database automatically clears the information below every day when its period ends. Information subject to account deletion is removed when we process the deletion request. The payment ledger is kept without a time limit as an exception explained below, and information kept by outside SDKs follows each provider's deletion process and periods.
| Information | Retention |
|---|---|
| Chat messages | 30 days |
| Photos | 30 days (same as chats). A photo hidden by a report can no longer be viewed right away and its file is deleted within one hour (cleanup every 15 minutes). Uploads that were never sent are deleted in the next cleanup after one hour |
| Read position | While you are in that room. Deleted when you leave the room or the room is deleted (including account deletion) |
| Rooms that never started | 1 day after creation |
| Game records of round rooms | 1 day after the scheduled end |
| Game records of endless-mode rooms | 14 days after the last chat |
| Push notification token on our server | Deleted when you delete your account. Turning off notifications on your device does not delete the server token automatically |
| Sign in with Apple connection token | Deleted when you delete your account. When you delete in the app, we first ask Apple to disconnect (revoke the token) |
| Kill records and name assignment events | 90 days. Deleted earlier if the room is deleted first |
| Lifetime stats and achievement progress | Until you delete your account. If a player you killed deletes their account, their identifier is deleted too |
| Event records | Until you delete your account |
| Daily rankings | Until the room is deleted. When you delete your account, your display name changes to "Deleted user" |
| Room notices (join, nickname change, Kill King) | Until the room is deleted. Nicknames written in the notices do not change even if you delete your account |
| Room nickname change records | Until that room is deleted (if you change it again in the same room, records older than one day are deleted). Deleted together when you delete your account |
| Rewarded ad records | 90 days, to prevent abuse |
| Ad reward verification diagnostic logs | 7 days. Your logs are also deleted when you delete your account |
| Purchase, grant and refund ledger | No time limit. When you delete your account, the link to your Service account is removed, but the purchase token, product, quantities granted and used, and processing times are kept |
| Firebase Crashlytics errors and related identifiers | Kept for 90 days as described by Google, then deletion from production and backup systems begins |
| Google advertising and Firebase installation information | Follows Google's retention and deletion rules for each service. Deleting your Service account does not immediately delete all of Google's identifiers and records |
| Meta ad performance measurement information (Android app) | Under the Meta Business Tools Terms, app event data is kept for up to 2 years. Deleting your Service account does not delete Meta's records |
| Items you own and nicknames | Deleted immediately when you delete your account |
| Word usage counts | No time limit (in a form that cannot identify individuals) |
When a room is deleted, its chats, kill records and rankings are deleted with it. However, the totals counted from those records (number of kills, games played and so on) and achievement progress stay with your account separately from the room, and are deleted when you delete your account. Information in our database is destroyed by deleting the records.
Why we keep the payment ledger: to prevent items from being granted again with the same purchase receipt and to handle grants and refunds consistently, we keep purchase tokens and grant history. When you delete your account, we clear the Service account link in the ledger, but we do not fully anonymize or delete the records such as purchase tokens themselves. Keeping them without a time limit is our current technical operating policy; it does not mean that a specific law requires permanent retention.
For how Google keeps and deletes the information it processes, see Firebase privacy and retention and Google retention.
For how Meta keeps and deletes the information it processes, see the Meta Privacy Policy and the Meta Business Tools Terms.
Exceptions required by law: if a law requires us to keep information for longer, we keep it for that period and then destroy it.
4. Sharing with third parties and service providers
We do not sell your personal information. We use the providers below for processing needed to run the Service, or provide the information below for ads and payments. In particular, AdMob's collection and sharing for advertising is explained in section 1(4), and Meta's ad performance measurement in section 1(5).
| Provider | Work and information | Notes |
|---|---|---|
| Supabase Inc. | Storing game data and photos, account authentication | The Service's database is hosted in Seoul, Republic of Korea (ap-northeast-2) |
| Google LLC — Firebase | Push delivery (FCM), error and diagnostic analysis (Crashlytics), processing installation and session identifiers | A service provider processing on our behalf. May be processed on Google's infrastructure outside your country |
| Google LLC — AdMob | The ad, interaction, diagnostic and identifier information in section 1(4), and the Service account identifier used to give rewards | Shared to provide ads, for analytics and to prevent fraud. Google's privacy policy applies |
| Meta Platforms, Inc. — ad performance measurement (Android app) | The device and network information and app install, launch and purchase events in section 1(5) | Provided with your optional consent to measure and optimize app install ads. Meta's privacy policy applies |
| Google LLC — Google account and Google Play | Account linking you choose, payment processing, and verifying purchases and refunds using purchase tokens and product identifiers | Google Play handles your payment method directly; we never receive card numbers or bank account numbers |
| Apple Inc. — Sign in with Apple and App Store | Account linking you choose and disconnecting it when you delete your account, payment processing, and verifying purchases and refunds | The App Store handles your payment method directly; we never receive card numbers or bank account numbers |
International transfers: the providers below process personal information outside your country, or receive it from abroad, as needed to run the Service. All transfers use encrypted connections (HTTPS).
- Supabase Inc. (a U.S. company, contact [email protected])
- Country: Republic of Korea (the database is stored in the Seoul region). Server functions run in the Supabase region closest to the user who made the request, so users outside Korea may be processed in a region near them (for example, the United States or Europe).
- Information: the Service data in section 1 (nickname, chats and photos, game records, account identifiers, purchase and grant records, and so on)
- When and how: sent over the network and stored each time you use the Service
- Purpose and retention: storing game data and photos and account authentication / the retention periods in section 3
- Google LLC — Firebase (a U.S. company, contact Google privacy inquiries)
- Country: the United States and other countries where Google has data centers (Google data center locations)
- Information: push notification tokens and notification contents (room name, sender's nickname, chat preview and so on), Firebase installation IDs, error and diagnostic records
- When and how: sent over the network when a notification is sent, while the app is running, and when an error occurs
- Purpose and retention: push delivery and error diagnosis / error and diagnostic records 90 days, undelivered notifications up to 4 weeks, push tokens and installation IDs until we ask Firebase to delete them (deleted from backups within 180 days after the request) (Firebase privacy and retention · FCM message lifespan)
- Google LLC — AdMob (a U.S. company, contact Google privacy inquiries)
- Country: the United States and other countries where Google has data centers (Google data center locations)
- Information: the ad-related information in section 1(4) and the Service account identifier used to give rewards
- When and how: sent over the network when the ad SDK in the app runs (requesting and watching rewarded ads and so on)
- Purpose and retention: providing ads, analytics and fraud prevention / under Google's published rules, ad data in server logs is anonymized by removing part of the IP address after 9 months and cookie information after 18 months (Google retention)
- Meta Platforms, Inc. — ad performance measurement (Android app) (a U.S. company, contact through the Meta Privacy Policy)
- Country: the United States and other countries where Meta has data centers
- Information: the advertising ID and Meta SDK installation identifier, device and network information (including IP address), and events for app installs, launches, time spent in the app and Google Play in-app purchases (product, price and currency) in section 1(5)
- When and how: sent over the network when you use the Android app or make a purchase after agreeing
- Purpose and retention: measuring and optimizing app install ads / app event data up to 2 years (Meta Business Tools Terms)
- Google LLC — Google account and Google Play (a U.S. company, contact Google privacy inquiries)
- Country: the United States and other countries where Google has data centers (Google data center locations)
- Information: authentication information when linking a Google account, purchase tokens and product identifiers
- When and how: sent over the network when you link a Google account, and when you buy, verify a purchase or a refund is checked
- Purpose and retention: account linking, payment processing and verifying purchases and refunds / account linking information until you delete your Google account. Payment and purchase records may be kept for a long time after you delete your Google account to comply with financial rules such as accounting, dispute resolution and tax (Google retention)
- Apple Inc. — Sign in with Apple and App Store (a U.S. company, contact Apple privacy inquiries)
- Country: the United States and other countries where Apple has data centers
- Information: authentication information and the connection token from Sign in with Apple, purchase transaction identifiers
- When and how: sent over the network when you sign in or link with Apple, when you delete your account in the app (disconnection request), and when you buy or a purchase is verified
- Purpose and retention: account linking and disconnection, payment processing and verifying purchases and refunds / Apple keeps Sign in with Apple information for as long as needed for the purposes it was collected for or as required by law. If you stop using Sign in with Apple with this app in your Apple Account settings, the link is removed, and if you delete your account in the app, we ask Apple to disconnect (Sign in with Apple & Privacy). Purchase records are kept for the period required by financial reporting laws (mostly at least 10 years) and may remain after you close your Apple Account (App Store & Privacy). The connection token on our server is deleted when you delete your account, as described in section 3.
Safeguards for transfers from the EEA and the UK: the European Commission and the United Kingdom have recognized the Republic of Korea, where our database is stored, as ensuring an adequate level of protection, so transfers to Korea need no additional safeguards. Our U.S. providers rely on their own transfer mechanisms, such as the EU-U.S. Data Privacy Framework (and its UK extension) or Standard Contractual Clauses.
How to refuse international transfers and what happens: linking a Google or Apple account and paid purchases are optional, so if you don't use them, the related transfers to those companies don't happen. Data storage (Supabase), push and error diagnosis (Firebase) and the ad SDK (AdMob) are built into the app and run as part of it, so if you do not want these transfers, you can stop using the Service and delete your account. Meta ad performance measurement in the Android app happens only with your optional consent; if you don't agree, or withdraw it in your profile, nothing is sent to Meta (information sent before you withdrew is kept under Meta's rules in section 3).
5. Your rights and how to use them
- Access and correction: you can change your nickname yourself in your profile in the app.
- Deletion: you can delete your account yourself in the app under My profile → Delete account. When you delete, the following disappears immediately.
- Your nickname (including nicknames set in each room and their change records), Google and Apple account links (including the Apple connection token), and push notification tokens
- Your participation records and stats in the group chats you are in, and the names assigned to you
- Kill log backgrounds, profile avatars, Instant Revives, Hint Tickets and stickers you own
- Your event number and event gift records
- Chats you sent
- Stopping processing: you can turn off push notifications for the app in your device settings. This only controls whether notifications are shown and is different from deleting the token on our server. You can ask for deletion or for other processing to stop at the contact below.
- Users in the EEA, the UK and other places with similar laws: you have the right to access your personal information and receive a copy (including in a portable format), to have it corrected or deleted, to restrict or object to its processing (including processing based on our legitimate interests), and to withdraw consent at any time. You can also complain to a data protection authority (section 8). We answer requests within one month.
- Users in the United States: depending on the state you live in, you may have the right to know what personal information we have about you, to correct it and to have it deleted. Send requests to the contact below; we will not treat you differently for using these rights.
How to ask for deletion without the app
If you have already removed the app or cannot access it, email [email protected] with Account deletion request in the subject and we will handle it. To confirm it is you, include the email address of the Google or Apple account you signed up with, or the nickname you used in the app and the code of a group chat you were in. We delete your account and reply within 5 business days of receiving your request.
What remains after deletion: other players' game records (kill records and daily rankings) are kept, with your display name changed to "Deleted user". Internal identifiers may remain in these records even after your Service account is deleted. Kill records are kept for up to 90 days and daily rankings until the room is deleted. Notices in a room (join, nickname change, Kill King) stay as that room's records, with the nicknames as written, until the room is deleted. Chats you sent are removed when you delete your account, and ordinary chats are kept for 30 days at most. Photos you sent can no longer be viewed right away and their files are deleted within one hour.
Also, the purchase, grant and refund ledger remains without a time limit for the reasons in section 3, after the link to your account is removed. Advertising, installation and error information processed by Google, and sign-in and payment records processed by Apple, follow those services' retention and deletion rules. So deleting your account does not mean every outside record and the purchase ledger are deleted immediately.
For any other request, contact us at the address below and we will handle it without delay.
6. Children
The Service does not accept users under 14, and we do not knowingly collect their information. If we learn that a user is under 14, we delete the account and related information without delay. Where the law of your country sets a higher age for giving consent to the processing of personal data (for example, 16 in Ireland), users below that age should not give the optional consent in section 1(5) without permission from a parent or guardian.
7. How we protect information
- All connections are encrypted (HTTPS).
- Row-level security (RLS) is applied to the database so that users can only read the records they are allowed to see.
- Sensitive operations such as granting items run only with server-only permissions and cannot be called from the app.
- The operator reads chats only for the report handling, abuse investigation and Service improvement stated in section 2 and only within the 30-day retention period, and never provides what was read to anyone else or makes it public.
8. Contact and privacy officer
| Item | Details |
|---|---|
| Service provider (controller) | Making Soul Studio (메이킹소울스튜디오, Republic of Korea business registration number 319-30-02011) |
| Privacy officer | Oh Sang-heon (오상헌), Representative |
| Address | 202-S23, 12 Jungang-ro 214beon-gil, Nam-gu, Ulsan, Republic of Korea |
| Contact | [email protected] (you can write in English) |
If you have a concern about how your personal information is handled, you can also contact the data protection authority where you live.
- Ireland: Data Protection Commission (dataprotection.ie)
- United Kingdom: Information Commissioner's Office (ico.org.uk)
- Canada: Office of the Privacy Commissioner of Canada (priv.gc.ca)
- Australia: Office of the Australian Information Commissioner (oaic.gov.au)
- New Zealand: Office of the Privacy Commissioner (privacy.org.nz)
- Republic of Korea: Personal Information Infringement Report Center (privacy.kisa.or.kr)
9. Website visit statistics
Our official website (www.makingsoulstudio.com) uses Cloudflare Web Analytics to understand visits. It does not use cookies, does not collect browser fingerprints, and does not track visitors across sites.
| Type | Details |
|---|---|
| Aggregate statistics | Pages visited, referrer (the previous site), approximate country, device and browser type, page loading performance |
| Not collected | Information that can identify individuals, cookies, advertising identifiers, tracking of each visitor's path |
The values are provided only in an aggregate form that cannot identify individual visitors, and are used only to improve the website. These statistics have nothing to do with the Killer Chat app.
10. Changes to this policy
If this policy changes, we will announce it in the app starting 7 days before it takes effect. Changes that are unfavorable to users will be announced 30 days in advance.
- 2026-10-19: English version published. It describes the same practices as the Korean policy effective 2026-10-13 (history of the Korean policy: first effective 2026-08-17; corrections and additions on 2026-08-18, 08-19, 08-20, 09-04, 09-07, 09-23, 09-27, 10-01, 10-11 and 10-13).