Privacy Policy

• Effective Date: April 15, 2026
• Last Updated: June 9, 2026
• Operator: GOATY (sole proprietorship, Republic of Korea)
• Website: www.goaty.gg

1. Overview

This Privacy Policy describes how GOATY ("GOATY," "we," "us," or "our") collects, uses, stores, and discloses information about you when you access or use the services available at www.goaty.gg (the "Service"), including when you create an account, upload content, or interact with any game or community feature on the platform.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please discontinue use of the Service. This Policy is incorporated by reference into our Terms of Service and should be read alongside it.

2. Data Controller

The data controller responsible for your personal information is the sole proprietor operating GOATY, registered under the laws of the Republic of Korea. For all privacy-related inquiries, please contact us at [email protected] and we will respond in a timely manner.

3. Information We Collect

3.1 Information Provided for Account Creation and Authentication

GOATY supports account creation and sign-in through Google, Discord, Twitch, GitHub, and email/password. When you sign in through an OAuth provider, we receive a limited profile dataset from that provider, which may include your display name or username, your email address (where provided by the OAuth provider), your profile avatar or photo URL, and a unique identifier issued by the OAuth provider. We do not receive, store, or have access to your password for any OAuth provider.

When you create or sign in to an account with email/password, we collect your email address, password authentication records stored in hashed form, and email verification data needed to confirm account ownership.

3.2 Content You Create and Upload

When you use the Service, you may create tier lists, bracket games, and polls, and you may upload images or other media files in connection with that content. This content is stored on our infrastructure as described in Section 6. You are solely responsible for the content you upload. We do not scan or analyze uploaded images for personal data beyond what is necessary for moderation and security purposes.

3.3 Information Collected Automatically

When you visit or use the Service, certain technical information is collected automatically. This includes log data (your IP address, browser type and version, operating system, referring URLs, pages visited, and timestamps), device information (device type, screen resolution, and language settings), aggregated usage data collected via Vercel Analytics, self-hosted Umami analytics data (such as page views, referrers, URLs visited, browser and operating system information, device type, approximate location derived from request metadata, Core Web Vitals, and custom event names and structured event properties), and cookie and tracking data as described in Section 8.

For custom analytics events, we may collect structured properties such as category, item count, tier count, export format, export quality, reaction type, authentication provider, or whether a profile field was updated. We do not intentionally send free-form user-generated titles, comments, or uploaded content to our analytics tools.

4. How We Use Your Information

We use the information we collect for the following purposes:

We do not sell your personal information to any third party, and we do not use your data for purposes incompatible with those described above.

5. Legal Bases for Processing

GOATY serves a global user base. For users located in the European Economic Area (EEA), the United Kingdom, or other jurisdictions with applicable data protection law, we rely on the following legal bases when processing your personal data:

6. Third-Party Service Providers

To operate the Service, we share data with the following categories of third-party service providers (each a "Processor"). These providers process your data only on our behalf and in accordance with our instructions.

6.1 Infrastructure and Hosting

6.2 Analytics

Note: Vercel Analytics and Umami are designed to be privacy-preserving. Umami does not use analytics cookies, and we do not use Umami Cloud; analytics data is stored in our self-hosted Umami database.

6.3 Authentication and Email Verification

6.4 Advertising

7. International Data Transfers

GOATY is operated from the Republic of Korea. However, many of our infrastructure providers — including Vercel, Convex, Cloudflare, Google, Discord, Twitch, GitHub, Resend, and Supabase — are based outside Korea or may process data through global infrastructure. Most core infrastructure and authentication data may be transferred to and processed in the United States and other countries where our service providers maintain edge infrastructure. Our self-hosted Umami analytics database is hosted by Supabase in AWS ap-northeast-2 (Seoul, Republic of Korea).

We rely on service providers that have implemented appropriate safeguards for international data transfers, including Standard Contractual Clauses (SCCs) where applicable, and maintain their own privacy and data protection certifications.

7.1 Notice for Users in the Republic of Korea (PIPA)

In accordance with the Personal Information Protection Act (PIPA) of the Republic of Korea, we disclose the following details regarding the overseas transfer of personal data:

• Country of Transfer: United States and, for the self-hosted Umami analytics database, Republic of Korea (AWS ap-northeast-2, Seoul)
• Receiving Entities: Vercel Inc., Cloudflare Inc., Convex Inc., Google LLC, Supabase, Inc., Discord Inc., Twitch Interactive Inc., GitHub Inc., and Resend, Inc.
• Purpose of Transfer: To provide infrastructure hosting, database management, content delivery, platform analytics, advertising, authentication, and email verification services.
• Items Transferred: Log data, IP addresses, account data (including email addresses, OAuth profile data, and password authentication records for email/password accounts), verification email data, user-uploaded media, and analytics data such as page views, event names, structured event properties, device/browser information, approximate location, and performance metrics.
• Retention Period: Personal data is retained only as long as necessary to fulfill the purposes outlined in Section 9. Raw self-hosted Umami analytics data is retained for up to 12 months, after which it is deleted or irreversibly anonymized.
• Right to Refuse: You may object to or refuse overseas transfer by deleting your account or contacting us at [email protected]. Because GOATY relies on overseas service providers to operate hosting, authentication, content delivery, advertising, and other core infrastructure, we cannot provide the Service if you refuse transfers that are necessary for those functions.

8. Advertising and Tracking Technologies

8.1 Cookies and Similar Technologies

The Service uses cookies, web beacons, and similar tracking technologies.

8.2 Google AdSense

GOATY uses Google AdSense to display advertisements. Google AdSense may set cookies on your device to serve ads based on your prior visits to this and other websites.

You may opt out of personalized advertising at any time by visiting Google Ads Settings or by using the Network Advertising Initiative opt-out tool.

8.3 Self-hosted Umami Analytics

GOATY uses a self-hosted Umami analytics instance to understand how visitors use the Service and to improve performance and product quality. Umami helps us measure page views, referrers, device and browser information, approximate location, Core Web Vitals, and custom events such as content creation, reactions, comments, downloads, profile updates, and authentication provider selection.

We configure our custom analytics events to avoid sending free-form user-generated titles, comments, uploaded media, or other content bodies. Umami analytics does not use cookies and is not used to track you across unrelated websites.

8.4 Do Not Track (DNT) & Global Privacy Control (GPC)

Some browsers allow you to broadcast a signal to websites indicating that you do not wish to be tracked. While we do not track you across the web ourselves, our third-party advertising partners (such as Google) may interact with these signals according to their own policies.

9. Data Retention

We retain your personal data only for as long as necessary.

10. Your Rights and Choices

Depending on your location, you may have certain rights with respect to your personal data (including GDPR rights to Access, Rectification, Erasure, Restriction, Portability, and Objection).

For California residents (CCPA/CPRA): You have the right to know what personal information we collect, the right to request its deletion, and the right to opt out of its sale. GOATY does not sell your personal information.

To exercise any of these rights, please contact us at [email protected]. We will respond to all verifiable requests within 30 days and will not discriminate against you for exercising your privacy rights.

11. Children's Privacy

The Service is not directed to children under the age of 14, and we do not knowingly collect personal information from children under 14. This minimum age reflects the requirements of the Personal Information Protection Act (PIPA) of the Republic of Korea. In certain jurisdictions (such as EU member states), the applicable age of digital consent may be higher (up to 16). If you do not meet the minimum age requirement in your country, you must not use this Service. If we become aware that we have collected personal data from a child below the applicable legal age without verifiable parental consent, we will promptly delete it.

If you do not meet the minimum age of digital consent in your country, you must not use this Service. If we become aware that we have collected personal data from a child below the legal age without verifiable parental consent, we will promptly delete it.

12. Data Security

We implement commercially reasonable technical and organizational measures (such as HTTPS/TLS encryption and access controls) to protect your personal data.

13. Changes to This Policy

We reserve the right to update this Privacy Policy at any time. When we make material changes, we will notify registered users by email or by posting a prominent notice on the Service. Your continued use of the Service after any change constitutes your acceptance of the revised Policy.

14. Contact Information

Last Updated: June 10, 2026 · GOATY · www.goaty.gg