This is an English translation provided for convenience. If it differs from the Korean version, the Korean version prevails. Read the Korean version (한국어).
BREYES (the “operator”) collects only the minimum personal information strictly necessary for “Iron Crown” (the web at realm.breyes.net and the Android app) membership sign-up and for providing the Service. We do not collect phone numbers, names or profile photos, and we collect an email address only if you choose email login. If you sign up with a username, we collect the username and password; the password is stored after being converted in an irreversible way (scrypt), so not even the operator can know the original value.
To delete your account and data, see 2. Deleting Your Account and Data.
1. Items Collected and Purposes of Use
| Category | Items collected | Purpose of use |
|---|---|---|
| Sign-up and login | If you sign up with a username: the username and password (stored in converted form); the member identifier issued by the login provider (Google or Kakao); if you choose email login: your email address; the types of login methods linked; records of your agreement to the Terms | Identifying members, login and re-authentication (including sending email verification codes), linking and unlinking login methods |
| Guest play | If you start without signing up: a session stored in a browser cookie (up to 400 days, extended each time you play) and a guest number | Continuing play in the same browser without logging in; linking a login method or moving to an existing member account |
| Play Games in the Android app | If you sign in to Play Games in the app: the player ID Google issues for this game and when it was linked (guests and members alike) | Signing you back in to your estate automatically when you reinstall the app or change devices |
| Game play | Lord name; records of game accounts, estates, items and currency (including Diamonds); session information | Providing the game service, protecting accounts, continuing play across multiple devices |
| App payments (Google Play) | Order number; the item bought, its price and currency; when it was bought and its state (verifying, delivered, refunded and so on); the purchase token and order number issued by Google Play; whether it was a test purchase; Diamonds granted, spent and taken back | Verifying purchases and delivering items, handling cancellations and refunds, preventing payment fraud, keeping transaction records as the law requires |
| Notifications (web push, optional) | For each device that turns on notifications: the push subscription address (issued by the browser’s push service) and its encryption keys, the notification language, the server and lord subscribed, when it subscribed; the kinds of notification the lord turned off | Sending game notifications such as finished construction and training, attacks on the home castle and rally calls |
| Chat | Messages sent in world and alliance chat and private messages sent to other lords, the time they were sent and how far each private conversation has been read; the lords you blocked and when; when a lord reports another lord’s message, the reporting lord, a copy of the reported message, the reason chosen, the time of the report and the operator’s decision | Delivering them to lords on the same server (world chat), in the same alliance (alliance chat) or to the recipient (private messages); hiding messages from lords you blocked and stopping their private messages; handling reports and investigating abuse, spam and other grounds for restricting use |
| Sending feedback | The message, its type and when it was sent; the operator’s reply; a receipt number for checking the reply (stored in converted form); your lord name and member number if you are logged in; device type (operating system and browser); the region found from your IP address (country and province; the IP address itself is not stored) | Checking bugs and improving the service, delivering the reply. Deleted one year after it is sent |
| Ad measurement | Only in a browser that arrived by clicking a Google or Facebook/Instagram (Meta) ad, to that ad's company: the ad click identifier, the cookies that company's tag keeps on realm.breyes.net, the fact that the first tutorial conquest was finished (one conversion), and the IP address and browser information the company receives then | Measuring which ads brought people who actually played, and spending the ad budget there |
| Android app usage analytics | On a device where the app is installed and run: the Firebase app instance ID, the advertising ID, device model, operating system, language and country, app version, the time of the first launch and of each launch (session), the fact that the first conquest was completed, and the install source (Play Store referral information). The same device's advertising ID and the fact of the install and launches also go to Meta (section 6 G). A game account started in the app records only the kind of install source (Meta ad, Google ad, Play Store or other). | Measuring which ads brought installs that actually opened the app, and the lords they started, and spending the ad budget there |
| Account transfer | Records of transfer requests, acceptances and cancellations; the member numbers of the parties | Processing transfers, investigating ownership disputes, preventing fraudulent use |
| Generated automatically | Service access logs (date and time of access, IP address, whether it was a login, sign-up or use); for each session, the device type (operating system and browser), the leading part of the IP address and the last access time; web server access logs (date and time, IP address, requested page address, browser information); security and operations logs | Retention required by applicable laws, blocking excessive requests, responding to security incidents, the list of signed-in devices on the account screen, visit statistics |
Guests do not enter personal information such as names or contact details. For a guest who goes more than 48 hours without accessing the game before capturing their first village, we delete the guest number, session, game account, estate, notification subscriptions and Play Games player ID link without delay (access logs are kept for the period required by law). Otherwise, if you clear your cookies or do not access the game for 400 days, there is no way to return to the guest estate unless you linked it through Play Games in the Android app, and its game records are managed in the same way as members' game accounts.
Paid items are sold only inside the Android app through Google Play billing; the web takes no payments. Payment details such as card numbers are handled by Google, and the operator never receives them. Notifications are sent only to devices on which you turn them on yourself; if you do not, none of the notification items above are collected. The region is looked up in a location database on the server itself; IP addresses are not sent anywhere else for this.
2. Deleting Your Account and Data
You can ask for your Iron Crown account (shared by the web and the Android app) and its data to be deleted in either of two ways.
- In the game: open “Account” from the “Menu” at the top of the game screen (or realm.breyes.net/account.html), log in, expand “Delete account” at the bottom and follow the steps. To confirm it is you, you must have logged in again within the last 10 minutes.
- By email: write to contact@breyes.net with your game server, lord name and the login method you signed up with, and we will process it after verifying your identity. Use this if you have removed the app, cannot log in, or are a guest without a login method.
As soon as you ask, all your game accounts are locked, and the deletion is put on hold for 30 days so that you cannot lose your account because of a request made by someone else. During this period you can cancel it by logging in with a linked login method. After 30 days, we delete the following without delay.
- Username and password, the login provider member identifier, the Play Games player ID, email address, sessions, account notifications and login history
- Chat and private messages, the lords you blocked, chat reports you made or received, and notification subscriptions (each device’s subscription address and keys, and the kinds you turned off)
- Your game accounts are closed for good and your lord name becomes “Departed lord”. Remaining Diamonds and items disappear.
The following records are kept, linked only to a member number separated from your login information, for the periods below and then destroyed: order, payment, delivery and refund records for 5 years; account transfer records and related operations records for 3 years; service access logs for 3 months. They remain in backup copies for up to 30 days before disappearing with them (section 4). If you want everything deleted at once without the hold period, ask by email.
You can also delete some data without deleting your account. Pressing “Turn off on this device” in the game’s notification settings deletes that device’s subscription at once. Other data (such as feedback you sent) is deleted on request by email after we verify your identity. Chat and private messages are deleted automatically 30 days after they are sent. You can unblock a lord yourself from the block list in the Messages tab.
3. Retention and Use Period
We keep your information until you delete your membership; how deletion works and what is kept afterwards is described in section 2. Records kept under the law or for the reasons below are kept for these periods.
- Order, payment, delivery and refund records (records of payment, supply of goods and withdrawal of orders): 5 years (Act on the Consumer Protection in Electronic Commerce (전자상거래법))
- Service access logs (date and time of access, IP address): 3 months (Protection of Communications Secrets Act (통신비밀보호법)). They are destroyed automatically when the period ends.
- Account transfer records and related operations records: 3 years (for handling ownership disputes)
Device information (device type, leading part of the IP address, last access time) is attached only to that session, and is deleted along with it when you log out or the session expires.
A notification subscription is deleted without delay when you turn notifications off on that device, or when the browser ends the subscription and its push service tells us it no longer accepts it. When a game account is transferred to another member, a membership deletion becomes final or a guest is cleaned up, that lord’s notification subscriptions and the kinds turned off are deleted too.
Chat and private messages are deleted automatically 30 days after they are sent, regardless of membership deletion, and are also deleted before then once a membership deletion becomes final. Your block list is deleted when you unblock a lord or once either lord’s membership deletion becomes final. Chat report records are deleted automatically together with the reported message, 30 days after that message was sent. If the operator removes a reported message earlier, the copy kept in the report record is still kept only until then. A report record is also deleted before then once the membership deletion of either the reporting or the reported lord becomes final. A reported lord is not told who reported them.
4. How Information Is Destroyed
Personal information whose retention period has ended, or whose purpose has been fulfilled, is destroyed without delay. Electronic records are deleted from the database so that they cannot be restored; we do not keep personal information on paper. For disaster recovery, database backups are made on the server; only the hourly copies of the last 48 hours and one daily copy for each of the last 30 days are kept, and older copies are deleted automatically. Deleted information may therefore remain in backup copies for up to 30 days before it disappears with them, and backups are used for nothing but recovery during that time.
5. Outsourcing of Processing
The operator entrusts the following processing tasks to provide the Service.
| Processor | Task | Location |
|---|---|---|
| The Constant Company, LLC (Vultr) | Hosting the game servers and storage (the processor only rents out the servers and does not access the data stored on them) | Seoul, Republic of Korea |
| Google LLC (Gmail) | Sending email verification codes | As in section 6 (international transfer) |
| Google LLC (Google Play) | Processing payments for paid items in the Android app; providing purchase verification and refund information | As in section 6 (international transfer) |
| Google LLC (Firebase Analytics) | Android app usage analytics (counting launches and sessions) | As in section 6 (international transfer) |
| Google LLC (Google Ads) | Ad measurement (only browsers that arrived from an ad click) | As in section 6 (international transfer) |
| Meta Platforms, Inc. (Meta ads) | Ad measurement (only browsers that arrived from a Facebook or Instagram ad click) | As in section 6 (international transfer) |
| Meta Platforms, Inc. (Meta SDK) | Measuring Android app install ads (counting installs and launches) | As in section 6 (international transfer) |
| The push service of your browser | Delivering web push notifications (the content is encrypted and the processor cannot open it) | As in section 6 (international transfer) |
6. International Transfer of Personal Information
The following transfers abroad are outsourcing needed to provide the services you request.
A. Sending email verification codes
| Recipient (contact) | Google LLC (privacy contact form) |
|---|---|
| Country | The United States and other countries where Google operates data centers |
| Items | Email address and the content of the email containing the verification code |
| When and how | Each time you request a verification code, sent to Gmail’s mail servers over an encrypted connection (TLS) |
| Purpose | Sending the verification code email |
| Retention | A copy of each sent email stays in the Sent folder of the sending Google account, and the operator deletes it within 30 days of sending. |
| How to refuse, and the effect | If you use a username, Google or Kakao login instead of email login, nothing is transferred. Refusing only means you cannot use email login; nothing else in the Service is restricted. |
B. Verifying Google Play purchases
| Recipient (contact) | Google LLC (privacy contact form) |
|---|---|
| Country | The United States and other countries where Google operates data centers |
| Items | The purchase token issued by Google Play, the product ID bought, the app’s package name |
| When and how | When you buy a paid item in the app, and when we check a purchase’s state such as a refund (including a daily check), sent to the Google Play Developer API over an encrypted connection (TLS) |
| Purpose | Confirming that a purchase was really paid, acknowledging and consuming it after delivery, confirming refunds and cancellations and taking back what was delivered |
| Retention | The purchase token and payment details are information Google already holds from processing the payment, and Google keeps them under its own privacy policy. The operator keeps them for the period in section 3 (5 years). |
| How to refuse, and the effect | If you do not buy paid items in the app, nothing is transferred. Refusing only means you cannot buy paid items; free play on the web and in the app is not restricted. |
C. Delivering web push notifications
| Recipient | The operator of the push service of the browser you use: Google LLC (Chrome and the Android app), Microsoft Corporation (Edge), Mozilla Corporation (Firefox), Apple Inc. (Safari) |
|---|---|
| Country | The United States and other countries where each operator runs its push servers |
| Items | The subscription address issued by that push service, the encrypted notification content (the game notification text, encrypted so that only your device can open it; the push service cannot see the content), and when it was sent |
| When and how | Each time there is something to notify, sent to that push service over an encrypted connection (TLS) |
| Purpose | Delivering game notifications to devices that turned them on |
| Retention | Until it reaches the device. If the device is off, each notification is kept for at most 1 day and then discarded. |
| How to refuse, and the effect | If you do not turn notifications on, or press “Turn off on this device” in the game’s notification settings, nothing is transferred. Refusing only means you do not get notifications outside the game; nothing else in the Service is restricted. |
D. Measuring Google ad results
| Recipient (contact) | Google LLC (privacy contact form) |
|---|---|
| Countries | The United States and other countries where Google operates data centers |
| Items | The ad click identifier, Google tag cookies, one conversion for the first tutorial conquest, and the IP address and browser information of the connection. Lord names, game accounts, member information and email addresses are not sent. |
| When and how | For 90 days from a Google ad click, in that browser only: Google's tag is loaded when the game page opens, and the conversion is sent once when the first conquest is finished (encrypted connection, TLS) |
| Purpose | Measuring ad results. Ad personalization signals are turned off. |
| Retention | Under Google's privacy policy and the Google Ads conversion window (up to 90 days after the ad click) |
| How to refuse and its effect | Open the address directly instead of through an ad and Google's tag is not loaded. You can also block third-party scripts or cookies in your browser. Refusing does not limit your use of the game. |
E. Measuring Meta ad results
| Recipient (contact) | Meta Platforms, Inc. (privacy contact form) |
|---|---|
| Countries | The United States and other countries where Meta operates data centers |
| Items | The ad click identifier (fbclid), Meta pixel cookies, one page view and one conversion for the first tutorial conquest, and the IP address and browser information of the connection. Lord names, game accounts, member information and email addresses are not sent. |
| When and how | For 90 days from a Facebook or Instagram ad click, in that browser only: the Meta pixel is loaded when the game page opens, and the conversion is sent once when the first conquest is finished (encrypted connection, TLS) |
| Purpose | Measuring ad results. The pixel's automatic collection of button clicks and the like is turned off. |
| Retention | Under Meta's privacy policy and Meta's ad conversion window |
| How to refuse and its effect | Open the address directly instead of through an ad and the Meta pixel is not loaded. You can also block third-party scripts or cookies in your browser. Refusing does not limit your use of the game. |
F. Android app usage analytics
| Recipient (contact) | Google LLC (privacy contact form) |
|---|---|
| Countries | The United States and other countries where Google operates data centers |
| Items | The Firebase app instance ID, the advertising ID, device model, operating system, language and country, app version, first launch and session times, the fact that the first conquest was completed, and the install source. Lord names, game accounts, member information and email addresses are not sent, and nothing else you do in the game is sent. |
| When and how | When the Android app is launched and when the first conquest is completed, to Firebase Analytics over an encrypted connection (TLS) |
| Purpose | Counting app launches and measuring ad results (linking the first launch of an install to a Google Ads ad). Automatic screen view reporting is turned off. |
| Retention | For the Google Analytics data retention period (2 months). Aggregated statistics may remain afterwards. |
| How to refuse and its effect | Playing in a web browser sends nothing. In the app, you can delete or reset the advertising ID under Android Settings → Privacy → Ads. Refusing does not limit your use of the game. |
G. Measuring Meta app install ads
| Recipient (contact) | Meta Platforms, Inc. (privacy contact form) |
|---|---|
| Countries | The United States and other countries where Meta operates data centers |
| Items | The advertising ID, the fact and time of the app's install and launches, app version, device model, operating system, language and country, and the IP address of the connection. Lord names, game accounts, member information and email addresses are not sent, and nothing you do inside the game screen is sent. |
| When and how | When the Android app is installed and launched, sent by the Meta SDK inside the app over an encrypted connection (TLS) |
| Purpose | Measuring ad results (linking an app installed from a Facebook or Instagram ad, and actually opened, to the Meta ad). Meta login and sharing are not used. |
| Retention | Under Meta's privacy policy and Meta's ad measurement period |
| How to refuse and its effect | Playing in a web browser sends nothing. In the app, you can delete or reset the advertising ID under Android Settings → Privacy → Ads. Refusing does not limit your use of the game. |
Apart from these, personal information is not transferred abroad, and all game servers run by the operator are in Seoul, Republic of Korea. If we add a server in another country for overseas players, then before that server goes into use we will add to this section the recipient and its contact details, the country, the items, when and how they are transferred, the purpose, the retention period and how to refuse, and post the change on this page and in the game notices 7 days before it takes effect.
7. Provision to Third Parties
The operator does not provide your personal information to third parties, except where the law requires it, such as a request from an investigative agency through the legal procedure. When you log in with Google or Kakao, you go through that company’s login screen, and the information processed there is governed by that company’s privacy policy. The operator receives only the member identifier from them (and no email address unless you separately choose email login). When you sign in to Play Games in the Android app, the operator receives only this game’s player ID from Google. Payment details you enter on the Google Play payment screen are likewise governed by Google’s privacy policy, and the operator receives only the purchase information listed in section 6 B.
8. Cookies and Browser Storage
We use one cookie, realm_session, for login and for continuing as a guest. Scripts in the browser cannot read it, it is sent only to realm.breyes.net, and it lasts up to 400 days. Other values, such as sound and notification settings and the receipt numbers of feedback you sent, are kept only in browser storage (localStorage) and are not sent to the server. Only in a browser that arrived by clicking a Google ad do we load Google's tag to measure ad results (section 6 D); it keeps the ad click identifier in cookies on realm.breyes.net (such as _gcl_aw). In a browser that arrived by clicking a Facebook or Instagram ad we load the Meta pixel for the same purpose (section 6 E); it keeps the ad click identifier in cookies on realm.breyes.net (_fbc, _fbp). We use no other advertising or analytics tracking tools. If you block cookies, you cannot log in or continue as a guest.
9. Security Measures
- All communication is encrypted with HTTPS (TLS).
- Passwords are stored converted with scrypt, and sessions and feedback receipt numbers with SHA-256, so the original values do not remain on the server.
- Web push notification content is sent with standard web push encryption so that only your device can open it.
- Only the operator can access the admin screens and the servers, and server logins are allowed only with access keys, never passwords.
- Login attempts are rate-limited, and excessive requests are blocked.
10. Right to Refuse Consent
You may refuse to consent to the collection and use of personal information. The sign-up items are strictly necessary for providing the Service, so if you do not consent, you cannot sign up as a member. Notifications and app payments process their information only when you choose to use them.
11. Children Under 14
Processing the personal information of children under 14 years of age (full age) requires the consent of their legal guardian (법정대리인). The Service does not currently provide this procedure, so only people aged 14 or older may sign up.
12. Your Rights and How to Exercise Them
You may at any time request access to, correction, deletion or suspension of processing of your personal information, withdraw your consent, and ask us to stop an international transfer, and the operator will act on the request without delay. How to delete your account or some of your data is described in section 2, and you can also send a request to the email address below. However, records that laws require to be kept may not be deletable during the required period.
13. Privacy Officer and Contact
| Privacy officer | The operator of BREYES |
|---|---|
| contact@breyes.net |
You can also report or seek advice about privacy infringements from the following Korean bodies.
- Personal Information Infringement Report Center (privacy.kisa.or.kr, 118 within Korea)
- Personal Information Dispute Mediation Committee (www.kopico.go.kr, +82 1833-6972)
- Supreme Prosecutors’ Office Cyber Investigation Division (1301 within Korea) · Korean National Police Agency Cyber Bureau (182 within Korea)
14. Changes to This Policy
If we change this policy, we will post the changes and their effective date on this page and in the game notices 7 days before they take effect. Changes that are unfavourable to users, such as collecting more items, will be announced 30 days in advance.
Previous versions: effective November 4, 2026 (before app first-conquest measurement) · effective November 3, 2026 (before Meta app install ad measurement) · third version effective November 1, 2026 (before Meta ad measurement) · second version effective November 1, 2026 (before Android app usage analytics) · first version effective November 1, 2026 (before ad measurement) · effective October 27, 2026 (before the Play Games player ID item) · effective October 6, 2026 (Android app payment, web push notification and chat report items and their international transfers added; section on deleting your account and data added) · “Notice on the Collection and Use of Personal Information”, effective September 23, 2026 (paid purchase items removed; outsourcing, international transfer, destruction, security measures and privacy officer sections added)