Privacy policy · Slowplay AI

This is a reference translation. The Korean original takes precedence. View the Korean original

1. Purpose and scope of this policy

리스너즈(lysners) (the "Operator") has established this policy to protect the personal information it processes in providing Slowplay AI. This policy applies to the Slowplay AI web service, the game API that runs at the same address, and customer inquiries.

Personal information controller: 리스너즈(lysners) · Representative 이재상 · Business registration number 278-56-01157
Business address: 서울특별시 서초구 사임당로18길 13, 4층 402-785A호(서초동)
Chief privacy officer: 이재상 (Representative) · js@lysners.com
Requests for access, correction, deletion or suspension of processing: js@lysners.com
General inquiries: js@lysners.com

Slowplay AI is an educational and entertainment role-play service for practicing poker decisions with fictional AI characters. You can't wager real money, deposit, withdraw, cash out, receive prizes, or send money between users.

Slowplay AI is currently open to adult users who are logged in. If needed, the Operator may switch to an invite-only mode in which only invited accounts can use it. Paid credits can be purchased only when an order button is shown on the credits page. When they are sold, Polar processes the payment as the Merchant of Record. The public landing page, policies and product descriptions can be viewed without logging in.

2. Personal information processed and purposes of use

Personal information processed and purposes of use
When processed	Items processed	Purpose of use	Required or optional
Sign-up and login	Email address, name (if entered), password hash (the original password is not stored), email verification status, account identifier, sign-up and last login times, login session	Creating and identifying accounts, keeping you logged in, email verification and password reset, preventing abuse	Required
Invitation to invite-only mode	Invited email address, operator notes, time of invitation and withdrawal	To confirm that an account was invited in invite-only mode and to manage its scope of use	Required in invite-only mode
Age eligibility check and consent	Selected country, applicable minimum age, determination result (available, restricted, unsupported), self-declaration method, time of determination, age policy version (2026-10-03), terms and privacy policy version (2026-11-08)	To check the adult age requirement for each country and to keep records of consent to the terms and notice of the privacy policy	Required
Play and coaching	Selected scenario, game session and state, poker actions, text you enter, character and coach messages and AI responses, decision records and review results	To run scenarios, determine legal actions, provide AI opponent and coach responses and reviews, and let you continue playing	Required for play
Credits	Records and timestamps of free and paid credit grants (daily free allowance, coupons, purchases), reservations, deductions, restorations and refund clawbacks; coupon codes you enter and the time you used them	Managing AI feature usage, granting the daily free allowance and coupons, granting and clawing back purchased credits, preventing duplicate coupon use, and checking for errors	Required for play
Paid credit orders, payments and refunds	Order number, order duplicate-prevention key, product and credits granted, order amount and currency, payment and tax amounts, order status, refund amount and credits recovered, times of order, payment and refund, Polar checkout session and order identifiers, and payment notification (webhook) identifiers	To create orders and prevent duplicates, grant credits after payment completion is confirmed, reflect refunds, retain transaction records, and handle payment inquiries	Required for purchases
Google sign-in	If you choose Google sign-in, the email address and email verification status, name, profile image address and Google account identifier that Google passes directly to Slowplay AI. We do not receive your Google password.	To create an account and sign in with a Google account	Required if you choose Google sign-in
Inquiries, reports and rights requests	The email address you send from, the content of your inquiry or report, the materials concerned and processing records	Answering inquiries, reviewing reports, and handling requests for access, correction, deletion and suspension of processing	Required when you make a request
Use of the service	Request time and path, IP address, browser information, error details, and token usage of AI requests	Incident response, security and prevention of misuse, and checking AI costs	Generated automatically
First visit through an ad link (when campaign values are present)	Campaign values in the ad link address (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the name of the ad click ID type (only which of gclid, gbraid, wbraid, ttclid or fbclid was present; the ID value is not stored), the path of the first page opened (without the query part of the address), the host name of the previous site, and the time of the first visit. Saved once, linked to your account, when you finish signing up (adult eligibility check)	To count which ad or campaign people signed up from and measure how well ads work. Not provided to ad platforms or other third parties, and not used for personalized advertising or behavior tracking	Generated automatically (only when you visit through a link with campaign values)
While you use the service (unless the signed-in account has opted out)	Screen navigation path (excluding the URL query), button clicks, screen recordings (these record changes on the screen but exclude the contents of input fields and text you type yourself), screen size category, and browser type. For visits without signing in, the service only counts daily totals by path, campaign value, language and screen size category, so no one can be identified	To improve the usage flow and identify errors. The operator processes this directly, without external analytics tools, and does not provide it to third parties. Nothing is recorded for accounts whose country chosen in the adult eligibility check is in the EEA, the United Kingdom or Switzerland	Optional (you can opt out, Article 8)

We process your date of birth only while calculating the minimum age for the country you select. We do not store it or keep it in logs. We do not use ID documents or external age verification providers. The operator does not collect or store payment method information such as card numbers. The name, email address, billing address and payment method information on the checkout screen are collected and processed directly on the Polar checkout screen by Polar, the seller, and its payment processor Stripe.

The operator does not ask for personal information in your play or coach questions. Text you type into an input field is sent to the external services listed in Article 6 for AI processing. Do not enter your resident registration number, bank account or card numbers, passwords, health information, or anyone else's personal information.

3. How we collect personal information

We collect information you enter directly on the screens for sign-up and login, age eligibility check, play and coach questions, and coupon entry.
When you log in with a Google account, we receive the email address and verification status, name, profile image URL and account identifier that Google passes directly to Slowplay AI during login (the login does not go through Runlot).
While invite-only mode is on, we keep the email addresses the operator has registered as invitees.
Records and logs are generated automatically through play, credit use and access to the service.
When you first arrive through an ad link (a link whose address carries campaign values), your browser stores those values in the first-party cookie slowplay_attr, and when you finish signing up (adult eligibility check), the server reads it once and records it linked to your account.
When you visit through a friend invitation link, your browser stores the invite code in the first-party cookie slowplay_ref. When you finish signing up (adult eligibility check), the server reads it once and registers it on your account as your invite code. If you use friend invitations, we record your account's invite code, the invitation relationship (who used whose code) and the status of invitation discounts and rewards.
When you order paid credits, we receive the payment status and the payment, tax and refund amounts through Polar's payment notifications (webhooks) and order lookups.
We receive inquiries, reports and rights requests that you send by email.
While you use the service, your browser sends screen navigation, button clicks and screen recordings to the operator's server (only if the signed-in account has not opted out). This process does not create cookies or visitor identifiers.

4. Retention period and deletion method

Retention period and deletion method
Category of information	Retention basis	How to delete or withdraw
Account and login	We keep this information while you use your account. The name, profile image URL and verified email received through Google login are also kept together with the account. A login session is valid for 30 days, an email verification link for 24 hours, and a password reset link for 1 hour. We store Google login sessions only as hashes, and we delete expired sessions when the same account logs in again.	If you request account deletion by email, we verify your identity, then delete the information linked to your account and revoke your sessions.
Invitation to invite-only mode	We keep this record while invite-only mode is on. If an invitation is withdrawn, we record the time of withdrawal.	We delete it when you request deletion or when invitation checks are no longer needed.
Age eligibility and consent records	We keep these records while you use your account.	We delete them when you delete your account. Information that we must retain by law is stored separately for the required period.
Play, coaching and credit records	We keep these records with your account so you can continue playing and review your hands. There is no automatic deletion deadline. The 30-day usage period for free credits is the period during which the credits are valid, not a retention period for the records.	You can request deletion of individual records or of your whole account by email. We also delete these records when you delete your account.
Paid credit order, payment and refund records	Under the transaction record retention standards in Article 6 of the Act on the Consumer Protection in Electronic Commerce and Article 6 of its Enforcement Decree, we keep contract and withdrawal records and payment and supply records for 5 years, and consumer complaint and dispute handling records for 3 years. The ledger of paid credits granted and reclaimed for the relevant order is kept for the same period.	If you delete your account, we keep these records separately for the retention period, use them only for that purpose, and delete them when the period ends.
Coupon use records	The coupon code you enter and the time you use it are part of the credit ledger. We keep them on the same basis as play, coaching and credit records.	We delete them when you delete your account.
Sent email records	We keep the headers and body of verification and confirmation emails for 30 or 365 days, depending on the operating platform plan, and then delete them automatically every hour.	You can request earlier deletion by email.
Database backups	We keep encrypted backups for disaster recovery. They are deleted after 7 or 30 days, depending on the operating platform plan.	Account deletion removes data in live operation. Backups that already exist disappear when their retention period ends.
Server logs	We keep them for 3 or 7 days, depending on the operating platform plan.	They are deleted automatically when the retention period ends.
External AI processing	The standard for each provider in Article 6 applies.	You can also request deletion of records held by a provider by email. The operator will tell you the scope and result of the processing.
Record of the first ad campaign visit	The `slowplay_attr` cookie in your browser lasts at most 30 days and is deleted when you finish signing up. The record saved and linked to your account at signup (campaign values, click ID type, first page path, previous site host, first visit time) is kept while you use your account.	You can delete the cookie in your browser settings at any time. If you request account deletion, the record is deleted together with the account.
Friend invitation records	We keep the account's invite code, who used whose invite code, the status of invitation discounts and rewards, and the link to payment orders for as long as you use the account. The `slowplay_ref` cookie in your browser lasts up to 30 days and is deleted when you complete sign-up.	If you request account deletion, we delete these records together with the account. The person who invited you does not see your friend's name or email, only the sign-up and payment status and dates.
Screen recordings, navigation and click records (usage analytics)	Screen recordings are kept for 30 days, and navigation and click records for 180 days, and then deleted automatically.	If you opt out through the account settings, the button on the cookie policy page or your browser's GPC signal, recording stops and that account's existing records are deleted immediately. They are also deleted when the account is deleted.
Daily view counts for visits without sign-in	These are stored only as daily counts by path, campaign value, language and screen size group, so no individual can be identified. They are kept for 400 days and then deleted.	Because this is an aggregate that does not identify individuals, it is not subject to individual deletion. If you turn on your browser's GPC signal, your visit is not counted.

The service does not yet have an account deletion feature, so please send your request to js@lysners.com. Receiving a request does not by itself trigger automatic deletion. After verifying your identity, a staff member will tell you the scope and result of the processing. If a law requires us to retain data, we will also tell you the legal basis and scope.

6. External services and overseas processing

The web service, game API, database, login and email delivery are handled on the Runlot platform, which the operator runs directly. For this purpose, the operator uses the infrastructure below and external AI services that generate responses for AI opponents and the coach. When paid credits are sold, Polar processes the payment as the seller.

External services and overseas processing
Service and operator	Purpose and items processed	Location, period and how to check
Vultr — The Constant Company, LLC	Operation of the service servers. They store and process service data, including accounts, age eligibility, play and credit records, usage analytics records (navigation and click records and screen recordings) and logs.	Uses servers in Seoul, South Korea. The retention standard is the same as in Article 4. Because the service is provided by a US company, support and security work may involve access from overseas. You can check the Vultr privacy policy.
Amazon Web Services	Email delivery. Processes your email address and the content of verification and confirmation emails.	Uses the Seoul region. The retention standard for delivery records is the same as in Article 4. AWS privacy notice
OpenRouter — OpenRouter, Inc.	AI request relay. Passes the game state, the sentences you enter and the conversation needed for a response to the model providers below. It does not send your account email, login identifier, age verification records or credit ledger.	United States. Unless a user turns on input and output logging, OpenRouter does not store prompts and responses. It keeps only request metadata such as token counts. The operator does not use this logging or the data use options. Data collection notice, Privacy policy
OpenAI, Microsoft Azure, Amazon Bedrock	Generates coach answers, opponents' table talk and scenario sentences. OpenRouter sends the request to one of these providers.	United States (Azure is in the United States or the EU). OpenAI keeps abuse monitoring records for up to 30 days. Under the standards OpenRouter has published, Azure and Amazon Bedrock do not retain prompts. None of the three uses API input to train models. OpenAI data processing notice, Retention policy by provider
TypeSafe — TypeSafe AI, Inc.	Decides the poker actions of AI opponents. Processes the game state and the list of available actions. The sentences you enter are not sent.	United States. Under the standards OpenRouter has published, prompts are not retained or used for training. TypeSafe privacy policy
Polar — Polar Software, Inc.	Processes payment for paid credits as the seller (Merchant of Record). The operator sends a customer identifier created from your account identifier, an order number, the product, price and currency, and the return address after payment. The operator receives the order status and the payment, tax and refund amounts. Polar collects the name, email, billing address and payment method you enter on the payment screen directly, and Polar's payment processor Stripe handles card information. Your account email, age verification records and play records are not sent.	United States. Polar discloses that it may transfer data to the United States, Canada and other countries, and it stores payment information such as the card type, the last 4 digits and the billing address. The retention period is the period for which your Polar account is maintained or the period needed to meet legal obligations. Polar privacy policy, Payment processing partners

Google is an identity verification service that you choose yourself as a sign-in method. It is not a processor to which the operator entrusts processing. If you choose Google sign-in, Slowplay AI sends you to the Google screen. After you complete authentication, Slowplay AI receives only the items above, which Google passes directly to Slowplay AI (the process does not go through Runlot sign-in). The operator does not send your play or credit records to Google in this process. Google privacy policy applies to Google's processing.

The following applies to the transfer of personal information abroad.

Items transferred: Game state, the text you enter in play and in coach questions, and the conversation needed to produce a response. Your account email and age verification records are not transferred.
Countries and recipients: United States: OpenRouter, Inc., OpenAI, TypeSafe AI, Inc., Amazon Web Services (Bedrock) / United States or EU: Microsoft (Azure). Contact details are in the privacy policy of each provider in the table above.
Timing and method of transfer: Each time an AI opponent or coach response is needed, the data is sent from the server over HTTPS.
Purpose of use and retention period: To generate AI responses. The retention period follows the standard of each provider in the table above.
How to refuse and the effect of refusal: No data is transferred if you do not start AI play or do not enter text. Because AI responses are a core feature, if you refuse the transfer you cannot use play and coaching. You can still view public pages and study materials.

The following applies to the transfer abroad that results from paid credit purchases.

Items transferred: A customer identifier created from your account identifier, the order number, the product, price and currency, and the return address after payment. You provide the information you enter on the payment screen directly to Polar.
Countries and recipients: United States: Polar Software, Inc. · 3500 South DuPont Highway, Dover, DE 19901, USA · privacy@polar.sh
Timing and method of transfer: The data is sent from the server over HTTPS when you press the order button to start payment and when the order status is checked.
Purpose of use and retention period: To process payments, calculate taxes, confirm orders, and handle refunds and payment disputes. The retention period follows the Polar standard in the table above.
How to refuse and the effect of refusal: No data is sent if you do not order paid credits. If you refuse, you cannot buy paid credits, but you can continue to use the product features with free credits.

We do not use third-party analytics or advertising tools. The operator processes ad performance measurement and usage analytics (Article 2) directly, without external tools. Usage analytics consists of navigation and click records and screen recordings when the signed-in account has not opted out, and daily view counts for visits without signing in. The items processed and retention periods are in Articles 2 and 4, and the opt-out methods are in Article 8. Before we start any new external service or analytics processing, we will first notify you of the purpose, items, external service and opt-out method, and obtain any required consent.

7. Cookies and browser storage

Cookies and browser storage
Type	Purpose	Retention period
`__Host-runlot_auth` cookie	Runlot Auth maintains the login session of users who sign in with email.	Up to 30 days or until you log out
`__Host-slowplay_session` cookie	Slowplay AI directly maintains the login session of users who sign in with Google. The server stores only a hash of a random value.	Up to 30 days or until you log out
`__Host-slowplay_oauth` cookie	Only during Google sign-in, it holds the values used to verify that the sign-in request matches (state, nonce and code verifier) and the path to return to after sign-in.	10 minutes or until sign-in succeeds or fails
Browser storage (localStorage)	Stores tutorial stars, best scores, number of attempts and completion times in this browser only.	Until you clear your browser data
Browser session storage (sessionStorage)	When you start a payment, it stores an order duplicate-prevention key in the current tab only, so that the same order is not created twice.	Deleted when you reach the order status screen or change the product or currency, and removed when you close the tab.
`slowplay_attr` cookie	Stored only when you first arrive through an ad link (a link whose address carries campaign values). It holds the campaign values in the link, the name of the ad click ID type (the ID value is not stored), the path of the first page opened, the host name of the previous site and the time of the first visit. The server reads it once at signup, only to count which campaign people signed up from, and does not share it with third parties.	30 days, or until you finish signing up
`slowplay_ref` cookie	We store this only when you visit through a friend invitation link (a link with `?referral=` and an invite code added to the address). It holds only one item: the inviter's invite code (six characters). It is used only so the server can read it once at sign-up and register it on that account as the invite code, and we do not share it with third parties.	30 days or until sign-up is complete
`slowplay.analytics.optOut` (localStorage)	This is essential storage that saves only your choice to opt out of usage analytics in this browser. It does not create usage analytics records.	Until you allow analytics again or clear your browser data

We do not use third-party analytics or advertising cookies or tracking tools. We store the slowplay_attr cookie above only when you first visit through an ad link, and the slowplay_ref cookie above only when you visit through a friend invitation link. Usage analytics (Article 2) does not use cookies and stores only your opt-out choice in the browser. You can clear cookies and storage in your browser settings, but if you block the sign-in cookie, you will not stay signed in. Clearing or blocking slowplay_attr and slowplay_ref does not affect your use of the service. For details, see the cookie policy.

8. Your rights and how to exercise them

You may request access to, correction or deletion of, suspension of processing of, and withdrawal of consent regarding your personal information, as well as deletion of your account. Where the legal requirements apply, you may also request the transmission of your personal information.
You can opt out of usage analytics at any time, and opting out does not change how you can use the service. You can opt out through the "Usage record collection" setting in My page (/profile), the "Opt out of usage record collection in this browser" button on the cookie policy page, or the browser's Global Privacy Control (GPC) signal. If a signed-in account opts out, recording stops and that account's existing screen recordings and navigation and click records are deleted immediately. Nothing is recorded from the start for accounts whose country chosen in the adult eligibility check is in the EEA, the United Kingdom or Switzerland.
Please send your request to js@lysners.com from the email address registered to your account. You only need to state the type of request and the account information needed for it. We will ask only for additional information that is strictly necessary to verify your identity.
After verifying your identity, the operator will process your request in accordance with applicable laws. If there is a legal reason to restrict or refuse a request, we will tell you the reason and how to object.
Even if the age determination ended as restricted or unsupported, you can ask us to review the determination again.

9. Security measures and complaint handling

We encrypt all transmissions with HTTPS, store passwords only as argon2id hashes rather than the original values, and keep database backups encrypted.
The product API checks login, beta invitation, account ownership and age eligibility on the server. Operational secrets stay on the server only, and access to personal information is limited to what is necessary.
If a personal information breach is confirmed, we assess its impact and contain it. Where the law requires, we notify the relevant authorities and affected users of what happened and how to respond.
You can send inquiries, complaints or requests for remedy about personal information processing to the Chief Privacy Officer (이재상, js@lysners.com). The operator replies within a reasonable period.

If you are not satisfied with how the operator handled your request, you can ask the following organizations for consultation or dispute mediation.

Personal information infringement report: Korea Internet & Security Agency (KISA) Personal Information Infringement Report Center · 118 (no area code)
Personal information dispute mediation: Personal Information Dispute Mediation Committee · 1833-6972
Personal Information Protection Commission: Personal Information Protection Commission

10. Age eligibility and protection of minors

Only people who are at least 18 years old and who also meet the Slowplay AI minimum age for the country they select may use product features such as AI play and coaching. The standards for each country are published in the Terms of Service. For unsupported countries and countries whose age standard we could not confirm, we do not automatically apply the age 18 standard.

A login account may be created before age eligibility is checked, but you cannot use product features until you pass the check. If you decline to provide your date of birth and country or to give a required consent, you cannot access product features, but you can still view public pages. This process is self-reported and does not verify your identity. If you learn that someone under the minimum age has created an account or provided personal information, please tell us at js@lysners.com.

11. Changes to this policy

The operator may change this privacy policy when laws, the service or the way personal information is processed change. We will publish the changes and the effective date on this page. For changes that are important to user rights, we will notify you through a service notice or by email before they apply, and obtain your consent again where necessary. This privacy policy takes effect on November 16, 2026. Within it, the provisions on advertising campaign cookies apply from November 14, 2026 as announced in the November 6, 2026 notice, and the provisions on usage analytics apply from November 16, 2026. Previous versions (effective 2026-11-14, 2026-10-30, 2026-10-15, 2026-10-14 and 2026-10-3) are available on request at js@lysners.com.