Privacy policy
PLUSH CLUB · Last updated September 13, 2026
PLUSH CLUB (the Service) is a free virtual claw game. There are no physical prizes or cash rewards, and coins cannot be purchased or exchanged for cash. The Service handles only the minimum information needed to run the game.
1. Information collected
| Information | When and why it is collected |
|---|---|
| Automatically generated identifier | A random ID is created on your first visit to associate coins and plushies with your progress. It does not identify you personally. |
| Display name (nickname) | Shown in queues and rankings. If you do not choose one, a name such as Player 123456 is generated automatically. |
| Public chat | Nicknames, messages and sending times in normal and challenge chat are visible to people in that room. The latest 50 messages per room are stored in the server database and survive restarts. When a new message brings the total above 50, the oldest is deleted automatically. Administrators may delete messages. Do not include personal information such as contact details. |
| Game records | Coin balance, score, owned plushies and play history are stored for game progress and rankings. |
| Username and password | Only when creating an account with a username. The original password is never stored; only a scrypt hash is kept. |
| Google account identifier | Only when using Google sign-in. We store only Google's unique identifier and display name. |
| IP address | Used to prevent mass account creation and repeated sign-in attempts from one source, and to limit chat spam. |
2. Information from Google sign-in
The permissions requested for Google sign-in are openid, email, profile, Google's basic non-sensitive scopes. We do not access Gmail, Drive, contacts or any other Google data.
We do not store email addresses. Only if Google does not provide a display name, the part before @ is used once as the display name, then the email is discarded. Only the Google account identifier and display name remain in our database.
3. Cookies
claw_player— Keeps you signed in. HttpOnly, SameSite=Strict.claw_oauth— Exists only for about 10 minutes during Google sign-in and prevents sign-in forgery (CSRF).- Admin session cookie — Only when an operator signs into the admin screen.
We do not use advertising cookies or tracking scripts. No external analytics tools are connected.
4. Retention periods
- IP-based abuse prevention records: automatically deleted within one hour.
- Completed game round records: automatically deleted after 30 days.
- Accounts, coins and plushies: retained while the account exists and removed upon a deletion request.
- Guest records: cannot be recovered once browser cookies are lost.
5. Sharing with third parties
We do not sell or share collected information with third parties. The Service runs on Fly.io infrastructure and stores data on its servers. We communicate with Google to process sign-in only when you use Google sign-in.
6. Your rights
You may request access to, correction of or deletion of your information. You can change your nickname anytime through My account → Change nicknamein the game. For full deletion of an account and records or unlinking Google, use the contact below. You can also revoke Google access on the Google account permissions page.
7. Children's privacy
The Service is not directed at children under 14 and does not knowingly collect their personal information.
8. Security
All communications are encrypted with HTTPS. Passwords are stored only as hashes, so even the operator cannot read the originals. No service can guarantee complete security.
9. Notice of changes
When this policy changes, the revision date on this page is updated. Important changes are announced separately within the Service.
10. Contact
Contact: fuso3367@kakao.com