Privacy Policy

1. Scope and controller

Eurion ("we", "us") publishes this Privacy Policy to explain how we handle personal data and to comply with applicable law. For the services listed below we determine the purposes and means of processing, which makes us the controller under the GDPR.

This policy applies to:

• the website eurion.co.kr
• the mobile application Chip Match: Cyber Merge Puzzle
• the mobile application Pushbin (listed on Google Play as Pushbin · com.hj.pushbin)
• the mobile application PushBin (To-dos & Routines, formerly SalimButton) (app name “PushBin”, previously 「살림버튼」 in Korean · com.slb.salimbutton) — a different app from Pushbin (notification archive and spending tracker, com.hj.pushbin) above
• the mobile application Hacker Cat: Idle Action RPG (listed on Google Play as “Hacker Cat: Idle Action RPG”, and in Korean as 「초보 해커 냥이 키우기: 방치형 RPG」 · com.bitcat.cybercat)

We apply the Personal Information Protection Act of the Republic of Korea as our baseline, together with the GDPR and UK GDPR for users in the European Economic Area and the United Kingdom, and the CCPA/CPRA for residents of California. Region-specific rights are set out in section 9.

2. Personal data we process

We do not collect special categories of personal data under Article 9 of the GDPR — such as data on race, health, sex life, or political opinions — nor sensitive information or unique identifiers as defined by Korean law.

3. How each app handles data

Our apps differ. The table below matches the declarations we make in the Google Play Data safety section.

Hacker Cat: Idle Action RPG has no Google sign-in, and we do not receive an email address, Google account identifier or display name from it. On first launch, if the device is online, an anonymous account is created on our server automatically, identified only by a random identifier with no name or email. From then on your progress (cloud save), nickname and ranking record are saved to the server automatically, and you take part in the in-game ranking automatically, so your nickname and record are visible to other players. When the server cannot be reached, the game keeps working from on-device storage alone. The advertising identifier and Firebase Analytics work independently of the account — reset or delete the advertising ID in your device settings if you would rather not have it used.

The same app records achievements and leaderboards in Google Play Games Services. If the device has a Play Games profile, sign-in happens automatically at launch; without one the game continues signed out — profile creation is offered by Google and declining it does not limit the game. Google keeps the player ID, gamer name, avatar, achievements and scores in the Play Games profile. Only scores verified by our server are sent to the leaderboards.

Once you are signed in to Play Games, the app sends a one-time server authorization code to our server. Our server checks the code with Google, receives your Play Games player ID, and links it to your anonymous account, recording when the link was made. This lets you get the same account and progress back after uninstalling and reinstalling the app or moving to a new device, by signing in with the same Play Games profile. We do not store your gamer name or avatar on our server.

The same app sells a one-time “Remove Ads” product through Google Play billing. Google handles card numbers and other payment details; we never receive them. When you buy, the app sends the purchase token to our server, which verifies the purchase with the Google Play Developer API, records the purchase token, order ID, product ID, price and currency, purchase time and verification and refund (revocation) status with your account identifier, and attaches the Remove Ads entitlement to your account. These records are used to verify purchases, to grant and restore the entitlement (after reinstalling or changing devices) and to handle refunds (a refund revokes the entitlement). We keep them for five years as required by Korea's Act on the Consumer Protection in Electronic Commerce.

The same app can show device notifications if you allow them — when your idle rewards are full, when the daily free supply arrives, or when you have not played for a few days. The app schedules these on the device ahead of time and the device displays them. Scheduling and display both happen on your device; we do not collect a push token or contact details, and nothing is sent from a server. The only permissions involved are notifications and alarm scheduling. On Android 13 and later the app explains what it will notify you about before asking for the notification permission, and declining does not limit the game.

Notifications are sent only after you have agreed to receive them by allowing the permission. You can switch each type off in the app's notification settings or withdraw the app's notification permission in your device settings. By default nothing is shown between 21:00 and 08:00 device time; notifications in that window are delivered only if you turn the night-time limit off in the app. If we ever introduce notifications sent from our own server (such as service notices), we will revise this policy in advance — including how device push tokens are handled — and announce the change.

A Hacker Cat: Idle Action RPG account and its data on our server are deleted on request by email (the app has no in-app delete option). The account deletion notice sets out how to ask, what to include, exactly what is removed and how long it takes.

The notification data Pushbin processes never leaves your device. It is not transmitted to us or to anyone else. You can withdraw notification access and delete the stored data from the app settings at any time.

PushBin (To-dos & Routines) has no sign-up or sign-in. To-dos, groups and routines with their check records, completion history, draw candidates, timer history, the log of notifications the app has shown, and your own affirmations and news cards are held in a database on the device only and never reach our server. Display mode, theme colour, and the gender and usage type (work, study, homemaking, everyday) chosen during first-time setup are kept in the device's app settings and are not sent anywhere either. The app has no analytics tools (such as Firebase Analytics or Crashlytics) and no payments.

The same app shows a Google AdMob banner ad at the bottom of the Settings screen. To load ads, the ad SDK sends the advertising identifier (Android Advertising ID), device and network information, IP address and similar data to Google and its advertising partners. Your to-dos and records are not passed to the ad SDK. The app has no separate screen asking for ad consent, and its ad requests do not specify personalised or non-personalised ads, so whether ads are personalised depends on Google's policies and your device's ad settings. You can reset or delete your advertising ID, or opt out of personalised ads, in your device settings.

The same app's Today's News tab uses the internet. When you open or refresh the tab, the app fetches news lists by category, an AI news summary and the daily affirmation set from a management server we operate ourselves (admin.eurion.co.kr). The requests carry only the news category name and the version number of the affirmation set; we do not include any account or device identifier or anything else that identifies you. As part of ordinary internet communication, however, the management server may record your IP address, the request time and the requested address in its access logs (web server logs), which we delete as described in section 7. The AI news summary is prepared in advance by the management server early each morning from the headlines of published news articles using Google Gemini; the app never calls Gemini itself, and none of your information is used in the process. If the management server does not respond, the app fetches news lists directly from Google News RSS (news.google.com), in which case Google receives ordinary connection information such as your IP address. Tapping an article opens it in an external browser, after which the publisher's and the browser's own policies apply. The downloaded affirmation set is stored on the device.

When you tap the microphone button in quick add, the app uses the speech recognition service on your Android device to turn your speech into text. The app does not store recordings or send them to us. Whether speech is processed on the device or on the service provider's servers depends on the speech recognition service set up on your device (for example, Google), and that provider's own policy applies to it. The microphone permission is requested when you use the microphone button; if you decline, you can still type your to-dos.

The permissions the same app uses are: showing notifications (timer finished, to-do and routine reminders), scheduling alarms at a set time, rescheduling reminders after the device restarts, the microphone (voice input) and the internet (ads and Today's News). Reminders are scheduled and shown on the device only; nothing is sent to our server to deliver them. Declining the notification permission leaves every other feature working. When you share a to-do or a reminder, it goes through the Android share sheet to the app you choose (such as KakaoTalk or SMS); we are not involved.

A PushBin backup file (JSON) is written only when you tap to create one, to the location you choose. It contains your to-dos, groups, routines, records, own affirmations and news cards, but not your display settings. You decide where to keep it and whether to share it; we never access it. Everything stored inside the app is removed from the device when you uninstall it, while a backup file you saved separately stays where you put it until you delete it.

4. Purposes and legal bases

For users in the EEA and the UK, we rely on the following legal bases under Article 6(1) of the GDPR.

Where we rely on consent, you may withdraw it at any time. Withdrawal applies going forward and does not affect the lawfulness of processing carried out before it.

5. Processors and disclosure

We do not sell personal information, and we do not disclose it to third parties except as set out below. We engage the following processors to deliver our services.

Sign-in sessions, cloud saves, and leaderboard entries for Chip Match: Cyber Merge Puzzle, and the anonymous account, cloud save, ranking, Play Games player ID, purchase records and usage records for Hacker Cat: Idle Action RPG, are handled on our own server (api.eurion.co.kr). That is processing by us, not by a processor. The server runs open-source software that we install and operate ourselves; your data is not passed to any third party, including the authors of that database software. The cloud infrastructure provider the server runs on is listed as a processor in the table above.

Today's News requests from PushBin (To-dos & Routines) — news lists, AI news summaries and affirmation sets — are likewise handled on a management server we operate ourselves (admin.eurion.co.kr); that too is processing by us, not by a processor. When the management server prepares the AI news summary, it sends Google Gemini only the headlines and publisher names of published news articles, never any information about you.

Account and data deletion for Chip Match: Cyber Merge Puzzle (developer hyunjungsnc) follows the account deletion notice; requests go to hyunjungsnc@gmail.com.

Account and data deletion for Hacker Cat: Idle Action RPG (com.bitcat.cybercat) is requested by email and follows the account deletion notice; requests go to manager@eurion.co.kr.

If our processors or the scope of their work changes, we will update this policy without undue delay. We may disclose data where a law enforcement authority makes a lawful request under the applicable procedure.

6. International transfers

Our services are available worldwide, and the processors above may handle personal data outside your country of residence.

• Recipients: the processors listed in section 5 (Google, Oracle, Cloudflare)
• Destination countries: the United States and other countries where those providers operate data centres
• When and how: transmitted over an encrypted connection at the moment the relevant feature runs
• Data transferred: as listed in section 5
• Retention: until the purpose is fulfilled or you ask us to delete it

For transfers out of the EEA or the UK to a third country, we work only with providers covered by an adequacy decision of the European Commission or by appropriate safeguards, including Standard Contractual Clauses.

You can avoid these transfers by not using the features that trigger them — personalised advertising, and sign-in, cloud save, and leaderboards in Chip Match: Cyber Merge Puzzle. Those features will then be unavailable. In Hacker Cat: Idle Action RPG the account, cloud save and ranking run automatically once the app is connected, so if you do not want this you can stop using the app and ask us to delete your account as described in section 8. Ads in PushBin (To-dos & Routines) come with the app, so if you do not want the transfers they involve you can stop using the app; you can reset or delete the advertising identifier in your device settings. The same app's Today's News requests are made only when you open or refresh that tab.

7. Retention and deletion

• Enquiries: kept for three years after the enquiry is resolved, then deleted, in line with Korean consumer dispute record-keeping rules
• Website access logs: deleted within six months of collection
• Management server access logs (PushBin (To-dos & Routines) Today's News): like website access logs, deleted within six months of collection
• Account and leaderboard data: deleted without undue delay when you ask us to delete your account (for Hacker Cat this includes the cloud save, nickname, upgrade and score verification records, the linked Play Games player ID, personal mail, unclaimed rewards and the usage records on our server)
• Usage records on our server (Hacker Cat): deleted automatically 90 days after collection
• Error reports (Hacker Cat, Firebase Crashlytics): deleted automatically 90 days after collection
• Purchase records (Hacker Cat): kept for five years as records of payment and supply of goods under Korea's Act on the Consumer Protection in Electronic Commerce, then deleted. If you delete your account during that period, the records are unlinked from it (anonymised) and kept only for the rest of the period
• Data stored on your device: deleted the moment you clear it in the app or uninstall the app; we have no access to it. A backup file you saved separately from PushBin (To-dos & Routines) stays until you delete it yourself
• Notification settings and scheduled notifications: stored on the device only; turning notifications off or uninstalling the app cancels the schedule and removes the settings
• Advertising identifier: retained under the advertising provider's own policy; you can reset or delete the identifier in your device settings

Electronic records are deleted by a method that prevents recovery. Paper records are shredded or incinerated.

8. Your rights and how to use them

Wherever you live, you may exercise the following rights.

• Access the personal data we hold about you
• Rectification of inaccurate data
• Erasure of your data
• Restriction of processing
• Portability — receive your data in a structured format or have it sent to another controller
• Objection to processing based on legitimate interests, and to direct marketing
• Withdrawal of consent

Write to manager@eurion.co.kr. We respond without undue delay and in any event within one month of receiving your request. Complex requests may take up to a further two months, and we will tell you why if that happens. We will not treat you differently for exercising these rights.

To delete a Hacker Cat: Idle Action RPG account, email the same address with the subject “[Hacker Cat] Account deletion request” and include the account code shown on the “Account” card in the app's Settings (eight letters and digits) and your nickname. The account deletion notice explains what to do if you no longer know the code, and exactly what is deleted.

Some things you can do yourself, without contacting us:

• Opt out of personalised ads and reset your advertising ID — Android Settings → Privacy → Ads
• Change or withdraw ad consent — in the game, Settings → Ads and privacy → “Review ad consent” (shown only where consent is required)
• View or delete Play Games achievements and scores — in the Play Games app, or Google Account → Data & privacy
• Clear in-app data or uninstall the app — this covers data on the device only; Hacker Cat accounts and data on our server are deleted on request by email, as above
• Withdraw Pushbin's notification access
• Turn Hacker Cat: Idle Action RPG notifications off — in the game, Settings → Notifications, or Android Settings → Apps → Notifications
• Withdraw PushBin (To-dos & Routines) microphone or notification permission — Android Settings → Apps → PushBin → Permissions or Notifications

9. Region-specific information

European Economic Area, United Kingdom, Switzerland

• Our legal bases are set out in section 4, and our transfer safeguards in section 6.
• Where our games (Chip Match: Cyber Merge Puzzle, Hacker Cat: Idle Action RPG) serve personalised ads to users in the EEA or the UK, we obtain consent beforehand through a Google-certified consent management platform. Without confirmed consent, we do not serve personalised ads.
• PushBin (To-dos & Routines) has no such ad consent screen. If you do not want the advertising identifier used for its ads, you can delete your advertising ID or opt out of personalised ads in your device settings.
• You have the right to lodge a complaint with the supervisory authority where you live or work (Article 77 GDPR). A list of authorities is available from the European Data Protection Board at edpb.europa.eu. In the UK, contact the Information Commissioner's Office at ico.org.uk.
• We have no establishment in the European Union. We are assessing whether we must appoint a representative under Article 27 of the GDPR, based on the scale and risk of our processing, and will publish the contact details here if we appoint one.

California, United States

• Under the CCPA/CPRA, California residents have the right to know what personal information is collected, from where, and why; to request deletion; to request correction; to opt out of the sale or sharing of personal information; and not to be discriminated against for exercising these rights.
• We have not sold personal information in the preceding twelve months. Providing an advertising identifier to an advertising provider for personalised ads may count as "sharing" under the CPRA. You can opt out through your device's personalised-ads setting or by emailing us.
• We do not sell or share the personal information of users we know to be under 16.

Republic of Korea

• Under Articles 35 to 37 of the Personal Information Protection Act, you may request access, correction or deletion, and suspension of processing.
• For reports or advice about privacy infringement, contact the Korea Internet & Security Agency privacy centre (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Supreme Prosecutors' Office cybercrime division (spo.go.kr, 1301), or the National Police Agency cyber bureau (ecrm.police.go.kr, 182).

10. Children

Our services are not directed at children. We do not knowingly collect personal data without verifiable parental consent from children under 14 in Korea, under 16 in the EEA (or the lower age between 13 and 16 set by a member state), or under 13 in the United States.

We do not serve personalised ads to users we recognise as children. PushBin (To-dos & Routines), which includes ads, is intended for users aged 18 and over. If we learn that we hold a child's personal data without the required consent, we delete it without undue delay. Parents and guardians who believe we hold their child's data should contact us using the details below.

11. Cookies, tracking, and automated decisions

• This website uses no cookies, no web analytics, and no tracking pixels. The website is hosted and delivered by Cloudflare (Cloudflare Pages) and loads fonts from Google Fonts, so opening a page sends your IP address and browser information to those providers.
• In our apps, the advertising SDK uses an advertising identifier and similar technology. You can reset that identifier or opt out in your device settings.
• We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR).

12. Security

• Data minimisation — we process only what the service needs
• Least-privilege access and access control
• Encryption in transit (HTTPS/TLS)
• AES-256-GCM on-device encryption of Pushbin notification titles, bodies, and schedules
• On-device by default — we do not add server transmission we do not need

13. Contact

Send all privacy questions, rights requests, and complaints to the address above.

14. Changes to this policy

If we add to, remove from, or amend this policy, we publish the change under Notices at least seven days before it takes effect. For changes that materially affect your rights, we give thirty days' notice.

Revision history

• Effective 4 October 2026 (revised 27 September 2026) — reflected the renaming of the mobile application SalimButton (com.slb.salimbutton) to PushBin (To-dos & Routines), and, in line with how the app now works, disclosed the Google AdMob banner ad on its Settings screen and the handling of the advertising identifier, how its Today's News tab fetches news, AI news summaries and affirmations from our management server (admin.eurion.co.kr) and that server's access logs, the Google News RSS fallback when the management server does not respond, voice input through the device's speech recognition service, and its permissions, sharing and backup files. Removed the earlier “no internet permission, no ads, no transmission” statements, and updated the data, purposes, processors, international transfers, retention, your rights, region-specific information and children sections accordingly. Because the website is now hosted on Cloudflare Pages and no longer loads style resources from third parties, Cloudflare's role was changed from “delivery of website style resources” to “website hosting and delivery”.
• Effective 1 October 2026 (revised 24 September 2026) — to find out why Hacker Cat: Idle Action RPG runs slowly or cannot finish its first battle on some devices, disclosed that the usage records on our server now include device information (device model, OS version, memory size, language and region settings) and battle screen update speed, and that crash and error reports are sent through Firebase Crashlytics. Updated the data, purposes, processors and retention accordingly.
• Effective 27 September 2026 (revised 20 September 2026) — brought the Hacker Cat: Idle Action RPG entries in line with how the app works: removed the Google sign-in data (email address, Google account identifier, display name) now that the feature has been taken out of the app; disclosed that an anonymous account is created automatically on first launch, that progress, nickname and ranking record are stored on our server and entered in the in-game ranking automatically, that the Play Games player ID is kept on our server so progress can be restored after reinstalling or changing devices, how in-app purchase (Remove Ads) records are handled and kept for five years, and that usage records on our server are kept for 90 days. Account deletion is now requested by email instead of from inside the app. Updated the data, purpose, processor and retention entries to match.
• Effective 23 September 2026 (revised 16 September 2026) — ahead of adding device notifications (idle rewards full, daily supply, come-back reminders) to Hacker Cat: Idle Action RPG, disclosed that they are scheduled and shown on the device only with nothing sent to our server, how the permission is requested, how to turn them off, and the night-time limit. Added notification settings to the data, purpose and retention tables.
• Effective 23 September 2026 (revised 16 September 2026) — added the mobile application Salim Button (com.slb.salimbutton) to the scope, and disclosed that it processes data on the device only, with no ads, accounts, or transmission, together with how its backup files are handled.
• Effective 15 September 2026 (revised 8 September 2026) — Hacker Cat: Idle Action RPG adds Google Play Games Services (automatic sign-in, achievements, leaderboards); added the processed data (player ID, gamer name, avatar, achievements, scores), the Google processing entry and the self-service controls.
• Effective 7 September 2026 — added GDPR, UK GDPR, and CCPA/CPRA coverage for worldwide app distribution, and disclosures on advertising, account sign-in, and international transfers.
  Revised 4 September 2026 (same effective date) — matched the Hacker Cat: Idle Action RPG entries to the shipped build: added usage statistics (Firebase Analytics), stated that Google sign-in is offered as an option, corrected the controller of cloud save and leaderboard data to our own server, and linked the account deletion notice.
• Effective 11 August 2026 — first version.

This English text is a translation provided for convenience. Where it differs from the Korean version, the Korean version prevails.