GODAERI / LEGAL

Privacy Policy

Innovision Games Inc. processes the information below to provide GODAERI accounts, personalization, community, and alerts. This policy follows the processing visible in the current code and database.
Effective date
2026-08-11
Last updated
2026-08-11

The Korean version is the governing text. Other languages are translations provided for convenience.

Revision history
  1. 2026-08-14

    Added disclosures for Google Firebase processing, purpose, retention, and international transfer for Android push notifications.

  2. 2026-08-11

    Rewritten to reflect the free open beta, actual feature access, public-data limits, personal-data processing, and external integrations.

  3. 2026-07-14

    Initial public version.

1. Controller

The controller is Innovision Games Inc., represented by Heebyeong Lee. A verified privacy contact and officer will appear on the company page and footer only when configured.

2. Registration and authentication data

  • Required: email, password hash for password accounts, required/optional consent type, version, time, and signup source
  • Optional Google sign-in: Google subject identifier, verified email, identity link and last-used time, short-lived state, nonce, PKCE verifier, and expiry
  • Session/security: SHA-256 hash of a random session token, creation and expiry, failed-login count and lock expiry
  • Authorization: user/admin role and specific API/Telegram access flag

3. Optional profile data

  • Public alias, bio, website, X and Telegram profile links
  • Uploaded profile-image bytes, MIME type, and update time
  • Information displayed to other users within the public-profile scope

4. Wallet Deck and alert data

  • Selected public wallet address, slot, source, selection/removal time, history, and card snapshot
  • Wallet-event copy including market, side, quantity, price, leverage and PNL, read and delivery status
  • For optional Telegram: AES-256-GCM encrypted bot token and Chat ID, hints, bot username, verification/test time, filters, and error codes
  • For Android push: Firebase Installation ID, local app-installation ID, app version, language, registration/deactivation times, and delivery results

5. Community data

  • Post body and rich-text document, market, sentiment, images, and deck snapshot
  • Comments, likes, bookmarks, reposts, follows, blocks, reports and resolution, notifications
  • Direct-message participants, body, client message ID, and created/read/edited/deleted times

6. Cookies and browser storage

The current code contains no advertising cookies or third-party analytics such as PostHog, Google Analytics, or Sentry.

__Host-falcon_session / falcon_session
Essential login cookie. In production it is HttpOnly, Secure, SameSite=Lax, for up to 30 days.
godaeri_google_oauth_state
HttpOnly anti-forgery cookie for Google authentication, expiring in about 10 minutes.
falcon_locale
SameSite=Lax language preference cookie for up to one year.
godaeri-theme
Light/dark preference in browser localStorage.

7. Purposes

  • Registration, login, sessions, account protection, and authorization
  • Public profile, Wallet Deck, wallet detail, and in-app, Telegram, and Android push alerts
  • Community posting, search, interaction, messaging, report, and block features
  • Event deduplication, rate limiting, incident diagnosis, security, and abuse prevention
  • Consent records and dispute handling

8. Public wallet data

Public Hyperliquid addresses and positions come from external public sources, and we do not identify their real owners. When a member saves an address, the relationship between that account and selection is treated as personalization data.

9. Retention

  • Session: up to 30 days, or until logout/session deletion
  • Google OAuth attempt: approximately 10 minutes and deleted when completed
  • In-app wallet alerts: code prunes records older than 90 days
  • Leaderboard snapshots and real-time activity buckets: code prunes records older than 7 days
  • Account, consent, profile, selection/history, community, and messages: while the account or feature is operated; automated full-account deletion is not implemented
  • Telegram settings: encrypted credentials are deleted when the connection is removed or access revoked
  • Android push installation data: deactivated on logout or unregister and retained while required to associate the installation with the account

10. Deletion method

Database records are deleted or overwritten to prevent practical recovery, and electronic files follow storage-provider deletion processes. Community content can first be soft-deleted, while minimum legal, security, or dispute records may be separated until their purpose ends.

11. External processing and transfers

The actual production hosting and managed-database provider cannot be proven from repository settings alone. Processor, country, contractual retention, and subprocessors require confirmation from the operating contracts before they can be named here.

  • Google (optional): OAuth and verified email for sign-in/linking; data may be processed outside Korea under Google's infrastructure and policy
  • Google Firebase (optional): when a signed-in Android user enables push notifications, the Firebase Installation ID and minimum wallet-event notification content are sent through Firebase Cloud Messaging and may be processed outside Korea
  • Telegram (optional): user bot token, Chat ID, and alert text for verification and delivery; data may be processed outside Korea
  • Hyperliquid public API: public wallet address and market identifier queried server-side; no user trading credential is sent

12. Security measures

  • scrypt password hashes with individual salts
  • Hashed session tokens and HttpOnly/Secure/SameSite production cookies
  • OAuth state, nonce, PKCE, and verified-email checks
  • AES-256-GCM encryption and key versioning for Telegram credentials
  • Role-based administration and wallet-address access, trusted-origin checks, rate limits, and login lockout
  • Image type/size and message-length validation, event and delivery deduplication

13. User rights

Members can manage public profile, profile image, Wallet Deck, Telegram settings, and community content in account screens and have rights to request access, correction, deletion, restriction, and consent withdrawal.

  • Marketing consent is optional at signup; no separate marketing delivery feature is visible in the current code.
  • Google unlinking and password changes are provided in account security.
  • Full-account deletion and a verified channel for statutory requests are not yet implemented/configured.

14. Children

The service is not designed primarily for children and has no age-verification or guardian-consent flow. A compliant process must be added before intentionally serving children where required.

15. Policy changes

Changes to data categories, external processing, retention, or rights are posted here with an effective date and summary. Separate consent is obtained where law requires it.