Privacy Policy
Effective date: 2026-11-11 · Version 2026-11-11
Fansdaq (the “Service”) is an unofficial fan support service in which team prices change according to actual sports and esports results. This policy explains what personal data the Service processes, why, for how long, and your rights. If a translation differs from the Korean original, the Korean original prevails.
1. Controller and contact
- Controller: Jungtae Kim (an individual operator in the Republic of Korea)
- Person responsible for data protection: Jungtae Kim
- Contact: [email protected]
Send all personal data requests and inquiries to this email. We respond in English and Korean and inform you of the outcome no later than 30 days after receipt.
2. Personal data processed
| Category | Data | Collection method |
|---|---|---|
| Account | Username, email address, password (stored only as a one-way hash), versions and timestamps of terms and policy consent | Entered at registration |
| Google sign-in | Unique Google account identifier, verified email address | Supplied by Google when Google sign-in is selected |
| Profile (optional) | Display name, bio, accent color | Provided by the user |
| Service use | Leagues and seasons joined, virtual amounts (V$), holdings, orders, trades, realized profit/loss, rankings, favorites and their order, visibility, language and time zone settings | Generated during use |
| Community | Follows, friendships, blocks, messages and attached images, support comments and attached images, reports and their outcomes | Created or requested by the user |
| Notifications | Notification records, web push subscription information (browser-issued endpoints and keys) | When notifications are enabled |
| Access and security | IP address, browser/device information (User-Agent), login sessions, rate-limit and abuse-prevention records, error logs | Automatically generated on access |
The Service does not collect real names, birth dates, phone numbers, addresses, payment details or precise location. No payment methods are collected because no real money changes hands. We do not request sensitive data (such as health or beliefs) and ask you not to enter such information in free-text fields.
3. Purposes and legal bases
| Purpose | Legal basis (EU and UK GDPR) |
|---|---|
| Account creation, maintaining login and providing features (virtual trading, rankings, profiles, messages, comments, notifications) | Performance of a contract |
| Preventing abuse, duplicate accounts and automated misuse; security incident response and troubleshooting | Legitimate interests (protecting the Service and users) |
| Handling reports and enforcing community rules | Legitimate interests, legal obligations |
| Sending web push notifications | Consent (withdrawable at any time in the browser or Settings) |
| Aggregate statistics for service improvement (nonidentifying visit counts and performance measurements) | Legitimate interests |
| Responding to lawful requests and disputes | Legal obligations, legitimate interests |
The Service does not sell personal data, share it with third parties for advertising or show personalized advertising. It does not make automated decisions or profile users in ways that produce legal effects. Automated security measures such as rate limits may nevertheless apply to prevent abuse.
4. Public information
The following information is public to other users and on the internet due to the nature of the Service:
- Username, display name, bio and accent color.
- Each league’s top 100 rankings and total assets, and the Hall of Fame (first-place records at season end).
- Support comments and attached images.
- Trades and holdings: the most recent 30 days follow the user’s visibility choice (private, friends or public); records older than 30 days become public automatically.
Messages and message images are available only to conversation participants.
5. Processors and third-party disclosure
The following providers process data as necessary to operate the Service. Contracts or terms require them to process data on the Service’s behalf and not for their own purposes.
| Provider | Processing | Location |
|---|---|---|
| SmileServ (iwinv) | Server and database hosting | Republic of Korea |
| Cloudflare, Inc. | Web traffic delivery and security (CDN, tunnels, Turnstile bot protection), image storage (R2), verification/reset emails, nonidentifying visitor statistics (Web Analytics) | Worldwide network (US headquarters) |
| Google LLC | Google sign-in authentication | US and other locations |
| Browser push services (Google, Mozilla, Apple, etc.) | Delivery of web push notifications when enabled | Respective providers’ locations |
Except for lawful requests under applicable law, personal data is not disclosed to third parties beyond these processing arrangements.
6. International transfers
The database is in the Republic of Korea. When users connect from abroad, information is sent to Korea and may be processed temporarily in other countries through these providers’ networks.
- EU and UK: the Republic of Korea has adequacy decisions from the European Commission and the UK government. Transfers to US providers follow their Standard Contractual Clauses (SCCs) or EU–US Data Privacy Framework certification.
- Korean users: overseas processing by Cloudflare and Google follows the data, purposes and provider details in the table above. You may request suspension of overseas transfers using the contact above. This may make certain features, such as Google sign-in or image attachments, unavailable.
7. Retention and deletion
- Account information and service-use records: retained while the account is active.
- Account deletion: deleting your account in Settings immediately removes the account, sessions, profile, trades, holdings, follows, and messages and images you sent from the Service. The Hall of Fame may retain only the fact of deletion and the display name at that time.
- Backups: copies may remain in operational backups for up to 30 days, then are deleted automatically.
- Security and access logs: deleted after up to 90 days. Records needed for legal violations or disputes may be retained separately until that purpose ends.
- Reports: retained for one year after handling.
Electronic files are deleted using methods that prevent recovery.
8. Cookies and browser storage
| Name/type | Purpose | Duration |
|---|---|---|
| Login session cookies | Maintaining login (HttpOnly, Secure, SameSite) | Until logout or expiry |
| Language/time zone preferences | Displaying the chosen language and time zone | Up to one year |
| Browser local/session storage | Interface preferences such as the last selected tab | Until cleared in the browser |
| Cloudflare security/performance cookies | Bot protection and security | Under Cloudflare’s policy |
The Service does not use advertising or tracking cookies. Visitor statistics use cookieless Cloudflare Web Analytics. Only strictly necessary cookies are used, so no separate consent banner is shown. Blocking cookies may prevent login.
9. Your rights
You may request at any time:
- Access, rectification, erasure or restriction of processing.
- Portability: receiving account data in a machine-readable format.
- Withdrawal of consent for consent-based processing, including web push.
- Objection to processing based on legitimate interests.
Most actions are available in Settings (editing profiles/visibility, disabling notifications, deleting accounts). Send other requests to [email protected]. We may contact your registered email to verify your identity.
Additional regional information:
- EU and UK: you may complain to your country’s data protection supervisory authority.
- California and other US jurisdictions: the Service does not sell personal information or share it for cross-context behavioral advertising. We do not discriminate for exercising rights.
- Brazil (LGPD): the contact above is the contact for the data protection officer (encarregado).
- Republic of Korea: assistance is available from the Personal Information Dispute Mediation Committee (1833-6972, kopico.go.kr), Privacy Infringement Report Center (118, privacy.kisa.or.kr), Supreme Prosecutors’ Office (1301) and National Police Agency (182).
10. Children
Only people aged 16 or older may register. If we learn that information about someone under 16 has been collected, we delete that account and information. Guardians who become aware of this should contact us using the details above.
11. Security measures
- Passwords are stored only as one-way hashes; all communications use HTTPS.
- Session cookies use HttpOnly, Secure and SameSite.
- Only the Operator accesses servers and databases, and access is logged.
- Image metadata, including location, is removed before storage; message images are available only to conversation participants.
- Regular backups are managed over encrypted channels and deleted after their retention periods.
12. Policy changes
Changes are announced within the Service seven days before taking effect. Material changes to users’ rights are announced 30 days in advance, with renewed consent obtained where necessary. Previous versions are available on request.