Effective date: November 1, 2026
HappyStock provides account registration and login, stock games and online multiplayer, virtual assets and rankings, quests, prize entries, and member messaging. This policy describes the personal information processing practices confirmed in the current service code. Please refer to the separate section on advertising services.
1. Information processed and purposes
| Use case | Information processed | Purpose |
|---|---|---|
| Registration, login and recovery | Username, nickname, salted and hashed password verification value, recovery-code hash, and login-session identifier hash | Account creation, identity verification, maintaining access, password recovery, and preventing unauthorized login attempts |
| Member profile | Nickname and visibility settings, nickname-change history, uploaded profile photos, and approval status | Displaying profiles, managing visibility settings, and reviewing profile photos |
| Games, virtual assets, rankings and quests | Game attempts and results, ratings, virtual asset balances and transaction history, attendance and quest completion records | Running games, managing records, awarding points, and providing member rankings and statistics |
| Prize entries | Member identifiers, entry amounts and times, entry records and draw results | Processing entries, preventing duplicate processing, and managing draw results |
| Member messages | Sender and recipient member identifiers, subject, content, and sent and read times | Delivering messages between members and the site operator |
| Online multiplayer | Member identifiers or temporary guest nicknames, temporary room-access identifiers, chat messages, company guesses, scores, and game state | Operating game rooms, distinguishing participants, and managing live gameplay |
| Access security | IP-address-derived hashes and counts of login attempts, and request information such as IP addresses handled during Cloudflare access and security processing | Restricting unusual access and repeated login attempts, and protecting the service |
We do not ask for email addresses or phone numbers during registration. The plaintext recovery code is shown to the member once, while the server uses a verification hash. Guests may join online multiplayer with a temporary nickname.
2. Retention and deletion
- Member accounts and activity records: Retained for as long as needed to provide the service. Ordinary members can request account deletion through the website’s account deletion feature. On withdrawal, the account and related data are handled through database deletion and cascading deletion procedures, although withdrawal may be restricted while a prize drawing is in progress.
- Login sessions: Valid for up to seven days from issuance. Earlier sessions may be invalidated by logout, account recovery, or account deletion.
- Login attempt restriction records: The code uses a 15-minute restriction window. The actual timing of database-row cleanup may vary according to separate operational and cleanup settings.
- Online game rooms: Deleted when the last participant leaves. Rooms that have not been updated for a period of time are subject to expiration and cleanup scheduled every minute. Game room data are not included in long-term member match records or rankings.
- Infrastructure records and backups: Logs, backups, and recovery history maintained by service providers such as Cloudflare may remain for some time according to those providers’ operational and retention settings, independently of when live data are deleted.
3. Cookies and browser storage
We use the __Host-hs_session cookie to maintain login sessions. To reconnect to online multiplayer games, temporary room information may be stored in the browser’s session storage. Users can delete cookies or site data in browser settings, but doing so may sign them out or prevent reconnection to a game room.
4. Service providers and external processing
The site uses Cloudflare Workers, D1, R2, access protection features, and Turnstile verification. During Turnstile verification for registration and account recovery, user requests and information such as IP addresses may be sent to Cloudflare. Data required for server and storage operation and security processing are handled through Cloudflare infrastructure and may be processed through infrastructure located outside Korea.
Depending on visibility settings within the service, member nicknames, profile photos, rankings, and game participation information may be displayed to other users.
5. If advertising is introduced in the future
If Google advertising is introduced in the future, Google and other advertising providers may use cookies, web beacons, IP addresses, or other identifiers to display ads, measure performance, prevent abuse, and provide personalized advertising.
How Google uses information from sites or apps that use its services
6. User rights and how to exercise them
Users may request access to, correction or deletion of, or suspension of processing of their personal information as provided by applicable law. Signed-in members can change their nickname and visibility settings under My Profile and use the account deletion feature. The in-site messaging feature allows messages to the operator, but requires login, at least 24 hours since registration, and compliance with message-sending interval limits.
7. Security and policy changes
The service code stores passwords using scrypt-based verification values, hashes recovery codes and session tokens, and uses HTTPS connections, login attempt restrictions, and Cloudflare Turnstile. Actual access controls, log retention, and backup practices depend on the operating environment. If the service’s processing practices change, the content and effective date of this policy will be updated.
Site operator
HappyStock · Individually operated website