Privacy Policy

Last updated: March 23, 2026

Hundred Core ("we," "us," or "our") operates the following services and applications (collectively, the "Services"):

• Moonlit Oracle (moonlitoracle.com) — AI-powered tarot and fortune-telling
• NyanQuest (nyanquest.com) — AI tabletop role-playing game
• Other mobile applications published under Hundred Core on Google Play and the App Store

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use any of our Services. Please read it carefully. By using our Services, you agree to the practices described in this policy.

1. Information We Collect

1.1 Information You Provide

• Account information: When you create an account, we collect your email address, display name, and profile picture through Google OAuth or email sign-up.
• User content: Text inputs, choices, and preferences you provide while using our Services (e.g., tarot questions, TRPG character actions).
• Payment information: When you make a purchase, payment processing is handled by Lemon Squeezy. We do not store your credit card numbers or banking details.
• Communications: If you contact us via email, we retain the content of your messages.

1.2 Information Collected Automatically

• Usage data: Pages visited, features used, session duration, and interaction patterns.
• Device data: Device type, operating system, browser type, language settings, and screen resolution.
• Log data: IP address, access times, and referring URLs.
• Cookies and similar technologies: We use cookies for authentication, preferences, and analytics. See Section 7 for details.

1.3 Information from Third Parties

• Google OAuth: When you sign in with Google, we receive your name, email address, and profile picture.
• Analytics providers: Aggregated usage statistics from Google Analytics.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Services
• Process transactions and send related notifications
• Authenticate your identity and manage your account
• Generate AI-powered content in response to your inputs
• Personalize your experience and remember your preferences
• Analyze usage patterns to improve our Services
• Display relevant advertisements through Google AdSense
• Communicate with you about updates, features, and support
• Detect, prevent, and address technical issues and abuse
• Comply with legal obligations

3. AI-Generated Content

Our Services use artificial intelligence models provided through OpenRouter (including models from Anthropic, Google, and other providers) to generate content such as tarot readings, fortune interpretations, and TRPG narratives.

• Your text inputs are sent to AI model providers to generate responses. These inputs are processed according to each provider's data handling policies.
• AI-generated content is for entertainment purposes only and should not be relied upon as professional advice (medical, financial, legal, or otherwise).
• We do not use your inputs to train AI models. However, third-party AI providers may have their own data retention policies.
• All AI-generated content in our Services is clearly marked as such, in compliance with applicable AI disclosure regulations.

4. How We Share Your Information

We do not sell your personal information. We may share your data with the following categories of recipients:

We may also disclose information if required by law, to protect our rights, or in connection with a merger or acquisition.

5. Data Retention

• Account data: Retained as long as your account is active. You may request deletion at any time.
• User content: Retained for the duration of your account to provide personalized services. AI conversation history may be automatically purged after 90 days.
• Usage and log data: Retained for up to 26 months for analytics purposes, then anonymized or deleted.
• Payment records: Retained as required by tax and accounting regulations (typically 5 years).

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data ("right to be forgotten").
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to processing of your data for certain purposes, including direct marketing.
• Withdrawal of consent: Withdraw consent at any time where processing is based on consent.
• Restriction: Request restriction of processing under certain circumstances.

To exercise any of these rights, contact us at osu355@gmail.com. We will respond within 30 days.

GDPR (European Economic Area)

If you are in the EEA, our legal bases for processing your personal data are: (a) your consent, (b) performance of a contract, (c) compliance with legal obligations, and (d) our legitimate interests in improving and securing our Services. You have the right to lodge a complaint with your local data protection authority.

CCPA (California)

California residents have the right to know what personal information is collected, request its deletion, and opt out of the sale of personal information. We do not sell personal information.

Korean Privacy Laws (PIPA)

In accordance with the Korean Personal Information Protection Act, we process personal data lawfully, collect only the minimum necessary information, and provide clear notice of our data practices. You may exercise your rights under PIPA by contacting us.

7. Cookies and Tracking

We use the following types of cookies:

• Essential cookies: Required for authentication and core functionality. Cannot be disabled.
• Analytics cookies: Help us understand how you use our Services (Google Analytics).
• Advertising cookies: Used by Google AdSense to display relevant advertisements.

You can manage cookie preferences through your browser settings. Disabling non-essential cookies may affect certain features.

8. Data Security

We implement reasonable technical and organizational measures to protect your data, including:

• Encryption in transit (TLS/HTTPS) and at rest
• Row-level security policies in our database (Supabase)
• OAuth 2.0 for authentication
• Regular security reviews

However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

9. Children's Privacy

Our Services are not directed to children under the age of 14 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. International Data Transfers

Our Services are operated from South Korea, and data may be processed in various countries through our third-party service providers. By using our Services, you consent to the transfer of your data to countries that may have different data protection laws than your country of residence. We ensure appropriate safeguards are in place for such transfers.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last updated" date. Your continued use of our Services after changes are posted constitutes acceptance of the revised policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy, or wish to exercise your data rights, please contact us:

• Company: Hundred Core
• Email: osu355@gmail.com
• Location: Seoul, South Korea