Nia Unbound Privacy Policy
What Nia Unbound receives when you sign in with Google, what it stores, and what it does not.
Effective 14 October 2026
1. Scope and operator
This policy covers only Nia Unbound, a PC game operated by JurevStudio (registered business name 레브스튜디오, representative 강동욱, business registration number 139-12-73459; "we"). Other services on this domain have their own policies.
Nia Unbound is in development and in closed testing. Only Google accounts registered as test users can sign in. When what we store changes, this policy changes with it.
2. What Google sign-in gives us
The game signs in through Google OAuth 2.0 as a desktop app. Your default browser opens, and once you pick an account it returns to 127.0.0.1 on your own machine. The game never receives or sees your Google password.
We request three scopes: openid, email and profile. The ID token issued for them carries the following.
| Field | What it is used for | Stored? |
|---|---|---|
| Google account ID (sub) | Identifies your game account. Your game account ID is "g_" followed by this number. | Stored on our server. |
| Email address | Shown in the game so you can see which account you signed in with. | Not stored. |
| Name | Shown for the same reason. | Not stored. |
We do not request or receive any other Google data — no contacts, calendar, Drive or photos. We do not store your profile picture.
3. How tokens are handled
- An ID token is valid for one hour. The game sends it when connecting; the server verifies the signature, issuer, audience and expiry against Google's public keys, then discards it. It is never stored.
- Google access tokens and refresh tokens are never sent to our server, and the server does not accept them.
- The refresh token stays in memory on your PC while the game runs. It is never written to disk, and it is gone when you sign out or close the game.
- Verifying a token means fetching Google's public keys. No information about you is sent to Google in that request.
4. What we store
This is the complete list of what the server keeps.
| Category | Fields | Purpose |
|---|---|---|
| Account | Game account ID ("g_" + Google account ID), sign-in platform, authentication marker, sign-up time, last access time | So the same Google account always reaches the same game account, and to block unauthorised access |
| Game data | Characters (name, class, level, experience, gold, stats, appearance, HP and recovery state, position), progression tree, inventory, equipment, account and character storage, Naia (owned, assigned, level), quest progress, trade orders (counterparty, contents, state) | So you can continue where you left off |
| Activity logs | Sign-in, character, item, party, quest, trade and battle records, including the game account ID and character name | To investigate bugs and data errors, and to settle lost-item and trade disputes |
| Access logs | IP address and timestamp recorded by the web server (nginx) | To run the server and respond to abuse |
Party composition and in-progress battle state live in memory (Redis) only and are not stored. No chat is stored at all — not proximity chat, whispers, party chat or shouts.
The game has shops and player-to-player trading, but both use in-game gold. There is no real-money payment, so we never receive payment details.
5. Retention
| Data | Kept for |
|---|---|
| Account and game data | Until you ask us to delete it. Nothing expires on its own. |
| Activity logs | 1 year |
| Game server file logs (include the game account ID) | 31 days |
| Web server access logs (include IP) | 90 days |
| Database backups | 30 days |
6. Deleting your account
There is no in-game delete button yet. Email dev@jurevstudio.com asking us to delete your account, from or naming the Google address you sign in with. We verify it is you and delete within 7 business days.
Deletion removes your account record and all game data — characters, inventory and storage, Naia, quests, progression tree and trade orders. It cannot be undone. Activity logs are not deleted immediately, because they are what settles disputes; they expire at the end of the retention period above (1 year).
Deleting a single character is something you can do in game. It is held for 24 hours and can be cancelled during that window, after which it is really deleted. The freed name is reserved for 3 days before anyone else can take it.
7. Sharing and processors
We do not share your information with third parties and do not use external processors. We collect no advertising identifiers and have no analytics or external log-collection services attached.
The server runs on a single Amazon Web Services (AWS) EC2 instance in the Seoul region (ap-northeast-2). The web server, game server, databases and backups are all on that one instance. No data leaves the Republic of Korea, so there is no cross-border transfer.
8. Security measures
- Google sign-in uses PKCE with a 127.0.0.1 callback, so the authorisation code cannot be intercepted.
- We never receive a password, so there is no password to leak.
- No Google token is stored on the server, so a server compromise leaves behind no credential that works against your Google account.
- Traffic between the game and the server is encrypted with TLS (Let's Encrypt). Until the dedicated domain is settled some development connections remain unencrypted; these are closed before public release.
- Backups are never exported off the server; they stay on the same disk.
9. Children under 14
The game is not for anyone under 14. If we find that an account belongs to someone under 14, we delete the account and its game data.
10. Your rights
You can ask to see, correct or delete what we store, or to stop us processing it. Email dev@jurevstudio.com; we verify it is you, act on it and tell you what we did. If you disagree with the outcome, reply to the same address.
In Korea you can also contact the Privacy Infringement Report Centre (privacy.kisa.or.kr, 118), the Supreme Prosecutors' Office Cybercrime Division (spo.go.kr, 1301) or the National Police Agency Cyber Bureau (ecrm.police.go.kr, 182).
11. Privacy contact
| Responsible person | 강동욱 (JurevStudio) |
| Contact | dev@jurevstudio.com |
12. Changes
When this policy changes we publish the new text and its effective date on this page. For changes that matter to you — new data collected, or any sharing with third parties — we post the notice here at least 7 days before it takes effect.