Caravan Online Privacy Policy

Version 2026-10-21-v1 · effective 2026-10-21

1. Who we are

1.1 Caravan Online (the "game", including its websites, apps, wiki and related services) is run by one individual in the Republic of Korea ("we", "us"). We decide how personal data is processed under this policy, and the same person is our privacy officer.

1.2 Privacy questions, requests and complaints go to Caravan Online Support at [email protected].

2. What we process

2.1 We may process these categories of personal data, as far as the features you use need them, from you, from your use of the game, from other players (a report that names you, with the voice clip it carries), and from the services named below:

• Account and sign-in data: guest keys, login id and password, identifiers from a sign-in service such as Google or from a platform or app store you play through, sessions, the confirmation that you are 14 or older and when you gave it, and account settings.
• Game data: characters and their names, appearance, position, progress and play time; coins, diamonds, items and the ledger of every move; trades, market orders and purchases inside the game; guilds, parties, friends, blocks, titles, achievements, rewards and other records of play.
• Communications: chat messages and whispers, voice in voice chat, names, guild texts and other text you enter in the game, reports you make or that name you, the lines around a reported message, and the voice clip sent with a report.
• Purchase data (when payments are available): what you bought, when, the price and currency, the payment method, the payment's status, cancellations and refunds, the reference numbers the payment processor gives us, and the name, mobile number and e-mail you enter on the payment screen, which go to the payment processors and may come back to us with the payment's details.
• Access and device data: IP addresses and the approximate location they show (country or region), sign-in and connection records with the time, browser, operating system and device type, device and browser identifiers (including identifiers our service creates and keeps in your browser), the character that played, and server logs of requests and errors.
• Usage and analytics data: pages visited, page speed and performance, the features, offers and versions of the game you were shown and how you used them, and similar statistics.
• Fair-play data: what your characters do in play (for example gathering, fighting, crafting, trading, movement and position over time), timing and input patterns, and the signals and scores that our systems derive from them.
• Submissions and support: wiki edit requests, feedback, bug and vulnerability reports, suggestions, and e-mail you send us, with your e-mail address and the content.

2.2 What other players see: your character's name, appearance, level, titles, guild, position in the world, chat messages, market orders and other things the game shows to other players by design.

3. Why we process it, and on what basis

3.1 We use the data above to:

• provide the game: accounts, sign-in, play, chat, trading, guilds, rewards, saving progress and support;
• sell and deliver paid features, handle payments, refunds and cancellations, and keep the records the law requires;
• keep the game fair and safe: detect and act on cheating, bots, macros, multiple accounts, real-money trading, fraud, abuse and attacks, recognise repeated violations, and enforce the Terms;
• operate, secure, fix and improve the service, measure use and performance, run statistics, research and experiments (different players may see different versions of features, offers or prices at the same time), and plan the game;
• review wiki edit requests, feedback and reports, answer you, and reward useful submissions;
• comply with the law and with lawful requests, settle disputes, and establish, exercise or defend legal claims.

3.2 Legal basis. In Korea we process data because it is needed to perform the contract you enter by playing (개인정보 보호법 제15조 제1항 제4호), to comply with legal obligations (같은 항 제2호), for our legitimate interests in a fair, safe and improving game where they clearly outweigh your rights (같은 항 제6호), within a purpose reasonably related to the original one (같은 조 제3항), and with your consent where we ask for it. Where the EU or UK GDPR applies, the bases are contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), legitimate interests (Art. 6(1)(f)), the interests named above, and consent where we ask for it (Art. 6(1)(a)), which you can withdraw at any time. Giving the account and game data is needed to play; without it we cannot provide the game.

3.3 Pseudonymised data. We may pseudonymise data so that it no longer identifies you without additional information, and use it for statistics, research and service improvement as 개인정보 보호법 제28조의2 allows. Records made from it are kept as long as they are useful, and the additional information is kept apart from them.

4. Automated decisions

4.1 To protect fair play, our systems may detect cheats, bots, macros, multiple accounts and abuse automatically, and apply measures automatically, such as reduced rewards, trade limits, temporary restrictions or suspension. They concern every player.

4.2 The main data they use are the fair-play data, access and device data and game data in section 2. They consider patterns that differ from ordinary human play, such as repetition, timing, movement, trading between related accounts and sign-in patterns.

4.3 You can ask us to explain an automated decision, to review it with human involvement, or, where the law gives you the right, refuse it, by writing to [email protected] with your login id or character name (개인정보 보호법 제37조의2, GDPR Art. 22).

5. How long we keep it, and deletion

5.1 We keep each category as long as its purpose needs, and at most for the period below. We may delete it earlier, except records 5.2 requires us to keep.

• account, game and communications data not listed below: until the account is deleted or closed; a guest that is not used may be deleted earlier;
• chat messages: at most three years, also after the account is deleted, to handle abuse, fraud and reports made later, to recognise repeated violations and to settle disputes;
• reports, sanctions and disputes, with the chat lines and other records tied to them except voice clips: at most five years, also after the account is deleted, from when the matter arose or the sanction ended, to recognise repeated violations and to handle disputes and legal claims;
• voice: our servers relay it as it is spoken and do not keep it; the game on a listener's device holds the last few minutes of voice it played, in memory only, and sends them only with that listener's report; a voice clip sent with a report: at most 90 days, or at most one year if it shows a violation;
• access and device data: at most one year;
• fair-play data: linked to your account for at most three years, or until the account is deleted if that comes first, then processed so that it can no longer identify anyone, and kept for statistics and research;
• usage and analytics data: as long as the purpose needs, and statistics that identify no one without limit;
• submissions and support e-mail: as long as needed to handle them, and at most three years after our last reply for the personal data in them;
• data needed for a measure under the Terms, a dispute, a legal claim or an investigation that is still open: until it is finally resolved, even beyond a period above;
• statistics made from any category so that they identify no one: without limit;
• backups: copies leave backups when the backups expire.

5.2 Records kept under the law. Where a law requires us to keep data, we keep it for that period: in Korea, records of contracts and withdrawals of orders, and of payments and delivery, for 5 years, and records of consumer complaints and disputes for 3 years (전자상거래법 제6조, 시행령 제6조 제1항).

5.3 The game's ledger. Coin and item moves are ledger entries that other players' balances depend on. When an account is deleted, its ledger entries remain, separated from its sign-in data and character names.

5.4 How we delete. Electronic records are deleted so that they cannot be restored in the ordinary way, and paper records, if any, are shredded.

6. Who receives it

6.1 Third parties. We give personal data to a third party only where Korean law allows it, such as with your consent or where a law requires or permits it (개인정보 보호법 제17조, 제18조). If the game or its business is transferred, the data may pass to the new operator as 제27조 provides.

6.2 Processors. Companies process data for us, in these roles:

• hosting the game servers, the database and its backups: OVH Hosting Inc.;
• delivering and protecting the websites and game files, sign-in traffic, visitor analytics, backup storage and forwarding e-mail sent to our address: Cloudflare, Inc.;
• our mailbox: Proton AG;
• payment processing, when payments are available: Korea PortOne Inc. (PortOne), KG Inicis Co., Ltd., the card companies, banks and easy-payment services you choose on their payment screens, and any other payment processor or platform shown on the payment screen.

6.3 Services you choose. If you sign in with Google, or play through a platform or app store, that company processes your data under its own policy and sends us an identifier for your account with it.

7. Data leaving Korea

7.1 Our servers and processors are outside Korea. We transfer data abroad because storage and processing abroad is needed for the contract and is disclosed in this policy (개인정보 보호법 제28조의8 제1항 제3호 가목). The transfers are:

• Canada. OVH Hosting Inc., 1801 McGill College Ave., Suite 800, Montréal, Québec H3A 2N4, Canada (privacy contact at ovhcloud.com/en-ca/terms-and-conditions/privacy-policy). All categories in section 2 except e-mail to us. Continuously while you use the game, over encrypted networks. Hosting the game and its database; kept for the periods in section 5.
• The United States and Cloudflare's global network. Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA ([email protected]). Requests to the websites and their responses including IP addresses, sign-in traffic, analytics data, database backups, and e-mail sent to us. At each request, and backups daily, over encrypted networks. Delivery, protection, analytics, backup storage and e-mail forwarding; backups for the period in section 5, and Cloudflare's own logs for the periods in its policy.
• Switzerland. Proton AG, Route de la Galaise 32, 1228 Plan-les-Ouates, Geneva, Switzerland (privacy contact at proton.me/legal/privacy). E-mail you send us. As each e-mail arrives, over encrypted networks. Keeping our mailbox; for the period in section 5.
• The United States (Google sign-in). Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (privacy contact at policies.google.com/privacy). The sign-in request and the response that identifies your Google account. When you choose Google sign-in, over encrypted networks. Completing sign-in; Google keeps data under its own policy.
• Payment processors outside Korea, when payments are available: the processor, its country and contact are shown on the payment screen (PortOne and KG Inicis process in Korea). Purchase data. When you pay, over encrypted networks. Processing the payment and refunds; for the periods in section 5 and the law.

7.2 Refusing. The game cannot run without the hosting and delivery transfers, so you refuse them by not using the game. You refuse the others by not e-mailing us, not choosing Google sign-in or not paying; you can still play.

7.3 Where the EU or UK GDPR applies, transfers rely on adequacy decisions (for Korea, Canada and Switzerland) or on the safeguards in the provider's data-processing terms, such as standard contractual clauses or the EU-US Data Privacy Framework.

8. Cookies, browser storage and analytics

8.1 The game uses cookies, browser storage and similar technologies to keep you signed in, complete sign-in, remember your guest, settings and layout, store game files so the game loads faster, protect the service, recognise the same browser across accounts and sign-ins to keep play fair, and measure visits and performance. Our pages load Cloudflare Web Analytics, which records page visits and performance. Without cookies or browser storage, our server records the referring site and the campaign tags in the link of a visit, counts visits by them, and links them to an account created from that visit.

8.2 Refusing. You can block or delete cookies and site data, or block scripts, in your browser's settings or with an extension. Without cookies you cannot sign in; without storage a guest is not remembered. Blocking analytics does not stop the game. We do not change our practices in response to browsers' "Do Not Track" signals.

9. Your rights

9.1 You can ask to see your personal data, receive a copy, correct it, delete it or your account, and suspend its processing (개인정보 보호법 제35조 to 제37조), withdraw any consent, and use the rights in section 4. Where the GDPR applies you also have the rights to restrict processing, to data portability and to object to processing based on legitimate interests. A legal representative or someone you authorise can ask for you.

9.2 How. Use the account options in the game, or write to [email protected] with your login id or character name. We may ask you to show that the account is yours. We answer within the time the law sets, and where we refuse or limit a request as the law allows, we tell you why.

9.3 Complaints. In Korea you can contact the Personal Information Infringement Report Center (privacy.kisa.or.kr) or the Personal Information Dispute Mediation Committee (kopico.go.kr). Elsewhere you can contact your data-protection authority.

10. Security

10.1 We protect personal data with administrative, technical and physical measures as 개인정보 보호법 제29조 requires: access limited to the people who need it, encrypted connections, passwords and sign-in tokens stored as hashes, access control, a database closed to the internet, security updates and records of access, and the physical security of our hosting providers' data centres.

11. Children

11.1 The game is not for children under 14, and the Terms do not allow them to play. If we learn that a player is under 14, we may close the guest or account and delete its data. A parent or guardian can write to [email protected].

12. Changes

12.1 Each version shows its version and effective date at the top of this page and applies from that date.

13. Language

13.1 English is the original text; the Korean text below says the same. Where this policy and a contract with you differ, the one more favourable to you applies (개인정보 보호법 제30조 제3항).