Privacy
Wanya
Privacy Policy
Version: 2026-10-30
Effective date: 2026-10-30
You can read this policy again at any time in the app under Settings > Terms & privacy, or at https://rivermountain-studio.com/wanya/privacy/
River Mountain Studio (리버마운틴스튜디오, "we", "us") makes the Android app Wanya (the "app"). This policy explains what information the app handles, why, how long we keep it, and how you can have it deleted. We follow the Personal Information Protection Act of the Republic of Korea and other laws that apply to you.
1. The short version
- We do not ask for your name, email address or phone number. There is no sign-up. When the app first connects to our server, it gets an anonymous user ID.
- Your original photo never leaves your phone. The app cuts out only your pet on your phone and sends that cut-out picture. Photo location data is never sent.
- The app has no ads, does not use the advertising ID, and contains no advertising or analytics tools.
- We do not sell your information or share it for advertising.
- You must be at least 14 in South Korea, or at least 13 elsewhere, to use the app.
2. What we process and why
2-A. Created when you use the app (required)
- Anonymous user ID (an Amazon Cognito identity ID): lets our server tell users apart and link your characters, in-game items and purchases to you. You can see it on the app's Settings screen.
- Usage records: game progress such as play, walks and gifts; records of in-game currency earned and spent; character creation requests; server processing records (time, request type, error codes). We use these to run the game, keep balances correct, prevent abuse and fix errors. Records made while offline are sent the next time you connect.
- IP address: processed briefly to block excessive requests. The server keeps only a one-way hash of it, which is deleted automatically within a few days. We do not use IP addresses to find your location.
2-B. Age check and consent records (required)
- Age group (adult, or 13 to 17), country, version of the terms you accepted, whether a parent or guardian confirmed, and when.
- Used to follow legal age rules and keep a record of consent.
- Your birth year and month are used only on your phone to work out your age. They are not stored or sent.
2-C. Creating a character (optional: only if you use this feature and agree to AI drawing)
- The cut-out picture of your pet (PNG), the species (dog or cat), your answers to questions such as ear and tail shape, and the drafts and final character drawn by AI.
- Used to draw a character that looks like your pet.
- The app tries to remove human faces when cutting out, but this may not be perfect. Please do not use photos that show people.
- You can also try the app with the sample photos included in the app, or with the prototype friend, without using your own photo.
2-D. Purchases (optional: only if you buy something)
- Google Play order number, purchase token, product, purchase time, store region and refund status.
- Used to verify purchases, deliver and restore items, and apply refunds.
- Payment details such as card numbers are handled by Google. We never receive them.
2-E. Google account link (optional: only where this feature is offered)
- We store only a one-way hash of your Google account's unique ID. We do not store your email address, name or profile photo.
- Used so you can get the same friends back on a new phone.
- This feature may not be shown in the first release.
2-F. Support emails (optional: only if you email us)
- Your email address, the message and any user ID you include.
- Used to answer you and handle access or deletion requests.
2-G. Google ML Kit inside the app
- Cutting out your pet and finding human faces happens on your phone using Google ML Kit. Photos are not sent to Google.
- According to Google, ML Kit may send Google device details (manufacturer, model, OS version), the app name and version, processing time, error codes and a per-installation identifier for diagnostics and usage statistics.
2-H. Kept only on your phone
- Your original photo (the app does not keep its own copy), the cut-out while a character is being made, your friend's name, birthday and the day you met, decorations and collection progress, and consent records.
- These are not sent to our server and are removed when you uninstall the app.
- The app opts out of Android device backup (Google account backup), so this data is not included in Google backups.
2-I. Sharing pictures
- Photo studio images and brag cards go to other apps only when you send them yourself with the Android share sheet. These images are drawn by the app and contain no location or device information.
3. How long we keep information
- Cut-out pictures: deleted automatically 1 day after upload.
- Drafts you did not choose: deleted automatically after 7 days.
- Anonymous user ID, final characters, usage records, age group and consent records: kept until you ask us to delete them.
- Server logs: 1 month. Payment verification and cost control logs: 3 months.
- Database recovery backups: deleted information can remain in recovery backups for up to 35 days before it disappears automatically.
- Support emails: 3 years after we finish answering, matching the retention period for consumer complaint records.
- Kept because the law requires it: under Korea's Act on Consumer Protection in Electronic Commerce, records of contracts, withdrawals, payments and delivery (order number, product, time) are kept for 5 years, and consumer complaint and dispute records for 3 years. If you ask for deletion, we keep these separately for that period only and then delete them.
4. Giving information to third parties
We do not give your personal information to third parties, except when the law requires it, for example a lawful request from an investigative authority.
5. Service providers
We use these companies to run the app. They process information only on our instructions and only for the work we give them.
- Amazon Web Services: servers and storage (stored in the Seoul region, South Korea).
- OpenAI: drawing the character from the cut-out pet picture.
- Google LLC: verifying Google Play purchases and refunds, and verifying the Google account link (where offered).
- Google LLC (Gmail): receiving and storing support emails.
6. International transfers
The following information is transferred abroad or handled by companies outside Korea to provide the service. We tell you about it here as allowed by Article 28-8(1)(3)(a) of Korea's Personal Information Protection Act.
6-A. OpenAI (United States)
- Recipient: OpenAI OpCo, LLC. Contact: the privacy contact listed at https://openai.com/policies/privacy-policy
- What: the cut-out pet picture, a drawing instruction built from your answers, and a short one-way hash instead of your user ID. Your original photo and your friend's name are never sent.
- When and how: each time you ask to create a character, over an encrypted connection (HTTPS).
- Purpose and retention: drawing the character. OpenAI says it may keep requests for up to 30 days to monitor abuse (longer if the law requires), and that it does not use API data to train its models.
6-B. Google LLC (United States)
- What: purchase token and order details (if you buy), ML Kit device and performance diagnostics, Google account verification data (if you use the link feature), and support emails.
- When and how: during purchase verification, while ML Kit runs, and when we receive email, over encrypted connections.
- Purpose and retention: purchase verification, diagnostics and email handling, kept according to Google's policies.
- Contact: the contact listed at https://policies.google.com/privacy
6-C. Amazon Web Services
- Data is stored in South Korea (Seoul region). We mention it because the company operating the service may be a foreign entity.
6-D. How to refuse, and what happens
- If you do not give AI consent on the character creation screen, no picture goes to OpenAI. You can still use the app with the sample and prototype friends.
- If you do not buy anything, no purchase data is checked with Google.
- If you do not want your information transferred abroad, email [email protected]. Features that need the transfer may then be unavailable.
7. How we delete information
- Information whose retention period has ended, or whose purpose is fulfilled, is deleted without delay (within 5 days at the latest).
- Electronic files are deleted so they cannot be recovered. We do not keep paper records.
- Information the law requires us to keep is stored separately and deleted when that period ends.
8. Your rights
- You can ask at any time to see, correct or delete your information, ask us to stop processing it, or withdraw consent.
- How: email [email protected] and include the "User ID" shown on the app's Settings screen. Because we do not collect names or contact details, the user ID is how we find and confirm your data.
- We will tell you the result within 10 days of receiving your request (within one month where the GDPR applies). When you ask for deletion, we delete your anonymous user ID, characters, usage records and age and consent records from our server, and ask our service providers, including OpenAI, to delete theirs. Purchase records the law requires us to keep are stored separately as described in section 3.
- Deleted friends and progress cannot be restored. Permanent purchases such as friend slots stay in your Google Play purchase history, so you can get them again with "Restore purchases" on a new account.
- Data kept only on your phone is removed when you uninstall the app.
- A parent, guardian or someone you authorize can make a request for you.
9. Children and teens
- People under 14 in South Korea, or under 13 elsewhere, may not use the app. We ask for birth year and month the first time the app opens.
- Users aged 13 (14 in South Korea) to 17 may use the app only after a parent or guardian reads the notice with them and gives permission.
- If we learn that we have processed information from someone below the minimum age, we delete it without delay.
10. How we protect information
- All traffic between the app and our server is encrypted (HTTPS), and each server request is signed with temporary credentials.
- Pictures and data stored on our server are encrypted at rest.
- Your pictures have no public address. They are delivered through links that work for 10 minutes, only after ownership is checked.
- OpenAI receives only a short one-way hash instead of your user ID.
- Server secret keys are kept in encrypted storage, and access to personal information is limited to as few people and permissions as possible.
11. Cookies and similar technology
The app does not use cookies or the advertising ID. Apart from the ML Kit diagnostics described in section 2-G, no analytics or advertising tool collects information automatically.
12. Privacy officer and contact
- Privacy officer: CEO (대표)
- Contact: [email protected]
- Send any privacy question, complaint or request for help to this address. We will answer without delay.
- Users in South Korea can also contact the Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr), the Personal Information Infringement Report Center (118, privacy.kisa.or.kr), the Supreme Prosecutors' Office (1301, www.spo.go.kr) or the Korean National Police Agency (182, ecrm.police.go.kr).
13. Users outside South Korea
- European Economic Area, UK and Switzerland: we are the controller of your personal data. Our legal bases are performance of our contract with you (app features and purchases), your consent (AI character creation), our legitimate interests (security, abuse prevention and fixing errors), and legal obligations (keeping purchase records). You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. You can also complain to the data protection authority where you live. Transfers to the United States rely on safeguards recognized by law, such as the standard contractual clauses offered by the provider.
- California and other US states: we do not sell personal information or share it for targeted advertising.
- Everyone can use the method in section 8 to exercise their rights.
14. Changes to this policy
If we change this policy, we will announce it in the app and at the web address 7 days before it takes effect, or 30 days before for changes that are important or less favorable to you. Earlier versions are available on request.
Operator: River Mountain Studio (리버마운틴스튜디오) Contact: [email protected]
If this English version and the Korean version differ, the Korean version prevails, except where the law of your country requires otherwise.