Privacy Policy
Effective: 2026-10-26 · Version: 2026-10-26
Storm of Madness (광기의 폭풍) ("we", "us") explains below what information the game "Boss Toss" (the "Service") handles and why. We follow the Korean Personal Information Protection Act and, where they apply, the EU/UK GDPR and the California Consumer Privacy Act (CCPA/CPRA).
1. What we collect and why
| Category | Data | Purpose | How collected |
|---|---|---|---|
| Account | Steam account ID (SteamID64), internal account number, account creation time | Sign-in, linking progress to your account | Our server verifies your Steam auth ticket with Steam |
| Profile | Nickname, profile image/frame, character appearance, communication (ping/sticker) loadout | Showing you to other players, saving settings | You set them |
| Gameplay | Room code, room and battle participation records, join/leave times, current screen (lobby, battle, etc.), time on screen, tutorial step | Providing the Service, presence, usage analytics, balance and UX improvement | Generated automatically by the client and server |
| Connection | IP address | Handling connections, rate limiting, latency (RTT) measurement, abuse prevention | Collected automatically on connection |
| Error reports | App version, OS and device information (CPU, GPU, memory, etc.), error type and call stack, actions leading up to the error | Finding and fixing crashes and errors | Sent automatically by the client (Sentry SDK), only in development and demo builds |
| Service health | Server metrics (player counts, processing times), server logs, traces | Keeping the servers stable, incident response | Sent automatically by the server (OpenTelemetry) |
| Planned | Country code (inferred from IP; only the code is stored), client language setting | Regional service quality, translation priorities | Generated by the server. This policy will be updated when introduced |
| Planned | Communication feature usage records (event log): type of ping, sticker, or emote, item used, scene, and an anonymous in-session slot (a/b/c/d). Contains no account number or SteamID | Usage analytics, service improvement | Generated automatically by the client and server. This policy will be updated when introduced |
| Planned | Cumulative use count per communication item, per account | Shown only to you as a loading-screen tooltip (easter egg). Not used for analytics | Counted automatically by the server. This policy will be updated when introduced |
We do not collect email addresses, phone numbers, real names, or payment information. Error reports are not tagged with identifiers such as Steam ID or email, and no screenshots are attached. The Service currently has no free-text chat. If chat is added, the "If chat is provided" section below applies.
If chat is provided (not available yet)
We will update this policy and give notice before offering text chat or similar features. The current plan:
| Data | Purpose | Retention | Who can read it |
|---|---|---|---|
| Message content, send time, sender account number, room | Automatic profanity/hate-speech filtering (processed in transit), handling reports | By default the original text is processed only while the message is sent and not stored. Messages that are reported are kept for 90 days after the report is resolved | Only the staff handling reports. Otherwise not read |
2. Legal bases (GDPR/UK GDPR)
| Processing | Legal basis |
|---|---|
| Account, profile, gameplay | Performance of a contract (providing the Service you asked for) |
| IP address, rate limiting, abuse prevention | Legitimate interests (securing the Service) |
| Error reports, service health | Legitimate interests (keeping the Service stable). You can object, see Section 7 |
| Chat filtering and reports (when provided) | Legitimate interests (a safe community) |
3. Retention
| Data | Retention |
|---|---|
| Account and profile | Until you ask us to delete it or the Service ends |
| Gameplay records and analytics events | 90 days |
| Communication feature usage event log (planned) | 90 days |
| Per-item cumulative use counts (planned) | Deleted together with the account |
| IP address (server logs) | 30 days |
| Error reports (Sentry) | 30 days |
| Metrics, logs, traces (Grafana Cloud) | 14 days |
If the law requires longer retention, we keep the data for that period.
4. Sharing, processors, and international transfers
We do not sell your personal information and we do not "share" it for cross-context behavioral advertising. We do not provide it to third parties except where the law requires it through lawful process.
We use the following providers, which means data is transferred outside your country:
| Recipient | Country | Data | Purpose | When and how | Retention |
|---|---|---|---|---|---|
| Valve Corporation (Steam) | United States | Steam auth ticket, SteamID64 | Sign-in authentication | At each sign-in, server-to-server over HTTPS | Per Valve's policy |
| Functional Software, Inc. (Sentry) | United States | Error report data | Error analysis | When an error occurs, sent by the client over HTTPS | 30 days |
| Grafana Labs (Grafana Cloud) | Japan (Tokyo) | Server metrics, logs, traces (may include IP addresses) | Server monitoring | Continuously by the server over HTTPS (OTLP) | 14 days |
| Cloud hosting providers (Oracle Cloud Infrastructure, Amazon Web Services, etc.) | Republic of Korea (Seoul), United States (Northern Virginia) | Account, profile, gameplay records, server logs | Running servers and databases | Continuously while the Service is used | As in Section 3 |
Where data is transferred from the EEA, UK, or Switzerland, we rely on the providers' adequacy decisions or standard contractual clauses where available. You can refuse a transfer by stopping use of the Service and contacting stormofmadness01@naver.com; transfers needed for sign-in cannot be refused while still using the Service. You can opt out of error reports by turning off "Send error reports" in the game settings.
5. Cookies and tracking
The Service does not use web cookies. The static pages that show these documents use no cookies or tracking tools. The game client sends error reports automatically as described in Section 1.
6. Security
- Encryption in transit (HTTPS/TLS)
- Least-privilege access to servers and databases, with access logs
- Keys and tokens kept in server environment settings, not in source code
- Default personal-data sending turned off in error reports
- Connection limits against excessive requests
7. Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal information, to object to processing, and to withdraw consent. California residents may also know what we collect, delete it, correct it, and limit use of sensitive information; we do not discriminate against you for exercising these rights. EU/UK residents may complain to their data protection authority.
To exercise a right, email stormofmadness01@naver.com with your SteamID64 so we can verify you. We respond within 10 days (and within the deadlines the law sets). An authorized agent may act for you.
8. Destruction
When retention ends or the purpose is fulfilled, we delete personal information without delay, in a way that cannot be recovered. If the law requires us to keep it, we store it separately.
9. Children
The Service is not directed at children under 14, and children under 14 may not use it. If we learn we collected data from a child under 14, we delete it without delay.
10. Data protection officer / contact
- Name: Myeongsik Kim
- Title: Team member (development)
- Email: stormofmadness01@naver.com
Korean users may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).
11. Changes
We will give notice in the game or at announcements on the Steam store page (https://store.steampowered.com/app/5379410/Boss_Toss_Demo/) at least 7 days before a change takes effect, and at least 30 days for important changes such as new data categories or new international recipients, and may ask for your consent again.