Privacy policy
PLUSH CLUB · Last updated October 1, 2026
PLUSH CLUB (the Service) is a free virtual claw game. There are no physical prizes or cash rewards, and coins cannot be purchased or exchanged for cash. The Service handles only the minimum information needed to run the game.
1. Information collected
| Information | When and why it is collected |
|---|---|
| Automatically generated identifier | A random ID is created on your first visit to associate coins and plushies with your progress. It does not identify you personally. |
| Display name (nickname) | Shown in queues and rankings. If you do not choose one, a name such as Player 123456 is generated automatically. |
| Public chat | Nicknames, messages and sending times in normal and challenge chat are visible to people in that room. The latest 50 messages per room are stored in the server database and survive restarts. When a new message brings the total above 50, the oldest is deleted automatically. Administrators may delete messages. Do not include personal information such as contact details. |
| Game records | Coin balance, score, owned plushies and play history are stored for game progress and rankings. |
| Email or username, and password | Only when you sign up with email (older accounts use a username). Email is used only for signing in and sending password reset mail. The original password is never stored; only a scrypt hash is kept. |
| Google account identifier | Only when using Google sign-in. We store only Google's unique identifier and display name. |
| Visit dates and referral | Whether you visited on a given day, and whether your first visit came from a shared or invite link or from which site (its domain only). Used only to compute operating statistics such as return rates on our server, and never sent elsewhere. |
| Shared photos | Only when you press Share on a result. The round's photo, your nickname at that time and the plushie name are stored, and anyone with the share link can see them. Photos you do not share are never sent to the server. |
| Password reset links | Only when you request a password reset. A one-time link valid for 30 minutes is created, and only its hash is stored on the server. |
| IP address | Used to prevent mass account creation and repeated sign-in attempts from one source, and to limit chat spam. |
2. Information from Google sign-in
The permissions requested for Google sign-in are openid, email, profile, Google's basic non-sensitive scopes. We do not access Gmail, Drive, contacts or any other Google data.
We do not store the email address received through Google sign-in. Only if Google does not provide a display name, the part before @ is used once as the display name, then the email is discarded. Only the Google account identifier and display name remain in our database.
3. Cookies
claw_player: Keeps you signed in. HttpOnly, SameSite=Lax, 90 days from your last visit.claw_oauth: Exists only for about 10 minutes during Google sign-in and prevents sign-in forgery (CSRF).- Admin session cookie: Only when an operator signs into the admin screen.
We do not use advertising cookies or tracking scripts. No external analytics tools are connected.
4. Retention periods
- IP-based abuse prevention records: automatically deleted within one hour.
- Completed game round records: automatically deleted after 30 days.
- Accounts, coins and plushies: retained while the account exists. Deleting the account immediately erases your email, username, password, Google link and nickname; game records remain, detached from anything identifying you.
- Shared photos: deleted automatically after 30 days, and immediately when the account is deleted. The operator can also delete them at any time.
- Password reset links: expire after 30 minutes and are deleted as soon as they are used.
- Visit date records: kept while used for operating statistics; after account deletion they remain without anything identifying you.
- Guest records: cannot be recovered once browser cookies are lost.
5. Sharing with third parties
We do not sell or share collected information with third parties. The Service runs on Fly.io infrastructure and stores data on its servers. We communicate with Google to process sign-in only when you use Google sign-in. Password reset mail is sent through Google (Gmail) mail servers.
6. Your rights
You may request access to, correction of or deletion of your information. You can change your nickname anytime through My account → Change nickname in the game. You can delete your account yourself under My account → Delete account; for other requests, use the contact below. You can also revoke Google access on the Google account permissions page.
7. Children's privacy
The Service is not directed at children under 14 and does not knowingly collect their personal information.
When signing up with email, we confirm that you are 14 or older; continuing with Google is likewise treated as confirming you are 14 or older.
8. Security
All communications are encrypted with HTTPS. Passwords are stored only as hashes, so even the operator cannot read the originals. No service can guarantee complete security.
9. Notice of changes
When this policy changes, the revision date on this page is updated. Important changes are announced separately within the Service.
10. Contact
Contact: fuso3367@kakao.com