Privacy Policy
Effective Date: March 1, 2026
AFTER6 ("Company") operates the AFTER6 platform ("Service"). This Privacy Policy explains how we collect, use, store, and protect your personal information in accordance with the Personal Information Protection Act (PIPA) of Korea.
1. Information We Collect
Required Information
- Email address, name (or nickname), password (stored encrypted)
Optional Information
- Profile image, location (city/district), preferred language (ko/en)
Club Activity Information
- Jersey number, position, date of birth
- Activity data generated through service usage (game records, attendance, statistics, etc.)
Automatically Collected Information
- IP address, device information (User-Agent), session data, service usage logs
Payment Information (Paid Services)
- Payment method and transaction history — processed through Lemon Squeezy (Merchant of Record). The Company does not store card numbers or sensitive payment data. Lemon Squeezy also collects billing address for tax calculation purposes.
How We Collect
- Directly from you during registration, profile editing, and club enrollment
- Through social login providers (Google, Kakao, etc.)
- Automatically during service usage
2. How We Use Your Information
| Purpose | Details |
|---|---|
| Account Management | Registration, withdrawal, identity verification, fraud prevention |
| Service Delivery | Club/league management, schedules, scores, standings, attendance |
| Club Activities | Roster management, player profiles, game records |
| Personalization | Location-based league recommendations, language settings |
| Paid Services | Subscription management, payment processing, refunds |
| Service Improvement | Usage analytics, error resolution |
| Customer Support | Inquiry response, announcements |
3. Data Retention
We retain personal information only as long as necessary for the purposes described above, unless a longer retention period is required by law.
| Data | Retention Period | Legal Basis |
|---|---|---|
| Account information | Until account deletion | User consent |
| Game records (snapshots) | Permanent | Essential for service integrity; stored as anonymized snapshots separate from personal data |
| Payment records | 5 years | Electronic Commerce Act, Article 6 |
| Access logs | 3 months | Protection of Communications Secrets Act, Article 15-2 |
| Fraud prevention (deleted accounts) | 90 days after deletion | Internal policy |
4. Sharing with Third Parties
We do not share your personal information with third parties except in the following cases:
- When you have given prior consent
- When required by law or requested by law enforcement through proper legal procedures
Information Visible Within Clubs and Leagues
When you join a club, the following information becomes visible to other members and league participants: name (nickname), jersey number, position, and profile image. This is necessary for core Service features (roster, game records) and you consent to this upon registration and club enrollment.
5. Service Providers
We use the following service providers to operate the Service. Each provider processes only the minimum data necessary for their function:
| Provider | Purpose | Data Shared |
|---|---|---|
| Supabase | Database & file storage hosting (Tokyo) | All user and service data |
| Vercel | Web application hosting (Global Edge) | Request logs (IP, User-Agent) |
| Upstash | Session cache (Tokyo) | Session data, anonymized usage stats |
| Lemon Squeezy | Payment processing (Merchant of Record) | Email, name, billing address, payment info |
| Google / Kakao / Naver | Social login (OAuth) | Email, name, profile image (received from provider) |
6. International Data Transfers
Our service providers operate servers outside of Korea. Your data may be transferred internationally as follows:
| Recipient | Country / Region | Purpose |
|---|---|---|
| Supabase Inc. | Japan (Tokyo, AWS ap-northeast-1) | Database storage and file hosting |
| Vercel Inc. | United States (Global CDN) | Web application hosting |
| Upstash Inc. | Japan (Tokyo) | Session cache |
| Lemon Squeezy LLC | United States | Payment processing, tax collection |
These transfers are protected by contractual safeguards and the providers' compliance with applicable data protection laws.
7. Data Deletion
- Process: Upon account deletion request, personal data is moved to a separate database and permanently deleted within 90 days. Data required by law is retained separately for the required period, then destroyed.
- Method: Electronic files are deleted using irrecoverable methods.
- Game Records: Even after account deletion, game records are preserved. However, personal identifying information is replaced with snapshot fields (name stored as plain text only), and the link to the original account is severed.
8. Your Rights
You have the right to:
- Request access to your personal information
- Request correction or deletion of your personal information
- Request suspension of personal information processing
- Delete your account (available directly in Service settings)
You may exercise these rights through the Service settings or by contacting us at support@after6.io. We will process your request without delay.
9. Security Measures
We implement the following technical and administrative measures to protect your information:
- Encrypted password storage
- HTTPS encryption for all communications
- SQL injection prevention (ORM parameter binding)
- Role-based access control (admin/user separation)
- Session management and expiration
- API rate limiting
10. Cookies and Advertising
The Service may display advertisements on free Club plans. Advertising cookies may be used in the future. Club Plus and above paid plans do not display advertisements.
- You can refuse cookies through your browser settings
- Refusing cookies may limit some Service features
- When ad networks are used, the respective network's privacy policy applies separately
11. Data Protection Officer
| Field | Details |
|---|---|
| Name | Sean Park |
| Title | Founder |
| support@after6.io |
12. Complaint Resolution
If you need to report or consult about a privacy issue, you may contact the following organizations:
- Personal Information Infringement Report Center (privacy.kisa.or.kr / 118)
- Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972)
- Supreme Prosecutors' Office Cyber Investigation Division (spo.go.kr / 1301)
- National Police Agency Cyber Bureau (ecrm.police.go.kr / 182)
13. Changes to This Policy
This Privacy Policy is effective as of the date stated above. Any changes will be announced through the Service at least 7 days before taking effect.