Mixdog Privacy Policy
1. General Provisions
TRIBGAMES (the “Company”) complies with the Personal Information Protection Act and other applicable laws. This Privacy Policy applies to the Mixdog desktop app, the Mixdog mobile apps (iOS and Android), the Mixdog web app used in a browser, and the relay service that connects them (the “Service”) provided by the Company. The Company’s game services are governed by the game Privacy Policy.
Mixdog requires no sign-up or Company account. The Company does not collect users’ names, phone numbers, location information, or advertising identifiers, and does not use usage statistics or analytics tools. The contents of coding work (conversations, code, and files) are not sent to Company servers.
2. Items of Information Processed
A. Information Processed on Company Servers (Relay)
The relay is used only when a user connects remotely to Mixdog on a PC from the mobile app or web app. If remote connection is not used, the information below is not generated. However, if a user uses the feature to send product feedback, “C. Sending Feedback” applies.
- PC registration information (automatic): A random device ID generated when the PC first connects, hashes of the device secret and pairing token (plaintext values are not stored), app version, UI layout (renderer) version, and last reported timestamp
- Connected device information (automatic upon pairing): A random ID of the connected phone or browser, a hash of the access token, the device-reported name, platform, and browser type (up to 80 characters each), connection timestamp, and last access timestamp
- Web push notification registration information (when notifications are enabled): The push subscription address (endpoint) issued by the browser, subscription keys sealed so that only the PC’s cryptographic identity can open them, IDs identifying which PC and connected device the subscription belongs to, and the server’s VAPID key for sending notifications (the server’s own key)
- Native push notification registration information (when notifications are enabled in the mobile app): APNs (iOS) or FCM (Android) device token, platform, and connected PC and device IDs. This information is kept only in the relay’s memory and is not saved to files; if the server restarts, the PC registers it again.
- Temporary information (kept in memory only): A 6-digit pairing code and one-time approval ticket (valid for 5 minutes), per-IP counters for rate-limiting connection attempts, and currently open connections
- Cookies: Sets a cookie containing the device ID (
mixdog_device, valid for 1 year) to serve the UI layout version matching the web app. It is not used for advertising or tracking. - Content transmitted during remote connections: Conversations, code, screens, and other content exchanged during a connection are end-to-end encrypted between the PC and the phone or browser, and the relay forwards only ciphertext. The Company does not view or store the content. Notification bodies are likewise encrypted by the PC before sending, so neither the relay nor Apple or Google can read notification contents.
- Webhook forwarding (optional feature): When a user enables Mixdog’s incoming webhook feature, requests sent by external services pass through the relay to the PC. Their contents are forwarded straight to the PC without being stored; they are not end-to-end encrypted, and are protected by transport encryption (HTTPS).
B. Service Access Logs
The relay program uses visitors’ IP addresses only in memory for rate limiting and does not save them to files. When access is denied, only the reason and the first 8 characters of the device ID remain in server operational logs. Any other access records are limited to what the server operating environment (network and system logs) retains as required by law.
C. Sending Feedback (Optional)
When a user uses Send Feedback in the app’s settings, only the user-entered feedback category (bug, suggestion, or other), feedback text (up to 8,000 characters), reply email address, and attached images (PNG, JPEG, or WebP, up to 3 images) are sent to the relay. Conversations, logs, and device information are not attached automatically, and the sender’s connection details such as IP address are not stored with the feedback. Feedback is held temporarily in a dedicated folder on the relay until delivered by email, and is sent via SMTP email to [email protected].
D. Information Processed Only on the User’s PC and Phone
For information stored only on the user’s device and not transmitted to the Company, see “7. Information Stored Only on Devices.”
3. Purposes of Processing
- Relaying remote connections between PCs and phones or browsers, device authentication, and access control
- Delivering notifications (using Apple, Google, and browser push services)
- Serving the web app UI version that matches the connected PC app version
- Preventing abuse such as brute-force attacks and excessive requests, and maintaining stable service operation
- Receiving and replying to feedback and inquiries, and fixing errors
- Checking for and delivering app updates
4. Retention and Use Periods
- PC registration information and connected device information: Until the user disconnects (unpairs) in the app. Upon disconnection, that information and the associated notification registration information are deleted immediately.
- Web push notification registration information: Deleted when disconnected, when notifications are disabled, or when the push service reports that the subscription has expired.
- Native push tokens: Cleared from relay memory upon disconnection, when a token is confirmed invalid, or when the server restarts.
- Pairing codes and tickets: Expire after 5 minutes and exist only in memory.
- Feedback: Held temporarily until email delivery completes; once sent, the text and attachments are deleted and only the receipt number, verification hash, and processing timestamp remain (up to 5,000 entries, oldest deleted first). Sent emails are kept in the Company’s mailbox for the period needed to handle the inquiry and then deleted.
- Information required to be retained under applicable laws is kept for the statutory period.
5. Provision to Third Parties, Outsourcing of Processing, and Cross-Border Transfers
The Company does not sell user information or provide it for advertising purposes. The providers below are involved in delivering Service features and may process information outside the user’s country, including in the United States. Information is transmitted over the network at the time the relevant feature is used.
| Recipient | Items Transmitted | Purpose of Use | Retention Period |
|---|---|---|---|
| HostPapa, Inc. (Relay server hosting, Los Angeles, USA) |
Information processed and stored by the relay (Section 2.A), connection information such as IP address | Operating servers to relay remote connections and notifications and to receive feedback | Same as the retention periods in Section 4 above |
| Apple Inc. (APNs, TestFlight) |
iOS device token, encrypted notification data, connection information such as IP address | Delivering iOS push notifications, distributing beta apps | Governed by the provider’s policy |
| Google LLC (Firebase Cloud Messaging) |
Android device token, encrypted notification data, connection information such as IP address. Device identifiers exchanged with Google by the FCM component included in the Android app | Delivering Android push notifications | Governed by the provider’s policy |
| Browser push services (Providers of the user’s browser, such as Google, Mozilla, Apple, and Microsoft) |
Web push subscription address, encrypted notification data, connection information such as IP address | Delivering web app notifications | Governed by the provider’s policy |
| GitHub, Inc. (GitHub Releases) |
IP address and information included in download and update-check requests, such as app version and operating system | Checking for and downloading desktop and Android app updates, downloading local model executables chosen by the user | Governed by the provider’s policy |
| AI provider chosen by the user (e.g., Anthropic, OpenAI, Google, xAI, OpenRouter, DeepSeek) |
Prompts entered by the user, code and file contents needed for the task, and the user’s own authentication credentials | Generating AI responses. Sent directly from the user’s PC to that provider without passing through Company servers. | Governed by each provider’s policy |
| Google LLC (Google Workspace, sending and receiving feedback emails) |
Feedback category, content, reply email address, and attached images | Delivering feedback to [email protected] | Governed by the Company’s mailbox policy |
Subscriptions, API keys, and privacy policies of the AI providers a user uses are governed by the relationship between the user and each provider. External integrations that a user enables directly—such as for code editing, web search, GitHub, or messengers—also connect directly to the service chosen by the user.
Privacy policies of each provider: Apple · Google · GitHub
If you do not want cross-border transfers, you may choose not to use the relevant features (remote connection, notifications, and updates) or delete the app; however, those features will not be available.
6. Google User Data (Gmail, Google Calendar, and Google Drive)
When a user connects Gmail, Google Calendar, or Google Drive in Mixdog’s connectors, Mixdog requests only the permissions below with the user’s consent on the Google sign-in screen.
| Permission | How It Is Used |
|---|---|
openid, email |
Display in the app which Google account is connected |
gmail.send |
Send emails requested by the user and approved in the app. Permission to read emails is not requested. |
calendar.events |
View, create, update, and delete calendar events at the user’s request |
drive.file |
Read and write only files created by Mixdog or explicitly selected by the user in Mixdog. It does not access the rest of Google Drive. |
- Where processing occurs: Google API calls are made directly from the user’s PC to Google. The Company does not receive or store Google user data on Company servers. Google sign-in tokens are stored only on the user’s PC.
- Transmission to AI providers: Only when necessary for a task requested by the user is the relevant Google data (for example, retrieved calendar events) sent to the AI provider chosen by the user to generate a response.
- Approval: Actions with external effects, such as sending emails or deleting calendar events, require the user’s approval before they run.
- Limited Use: The Company does not sell Google user data, use it for advertising, or transfer it to third parties other than the AI provider transmission described above. No human views the data, and it is not used to train or improve generalized AI models.
- Disconnecting: Users can disconnect at any time from Mixdog’s connectors screen, which deletes the tokens stored on the PC. Users can also revoke Mixdog’s access on the Google Account Permissions page.
Mixdog’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
7. Information Stored Only on Devices
The information below is stored only on the user’s device and is not transmitted to Company servers.
- Desktop app (PC): Conversation history and sessions, project files, settings, AI provider authentication credentials (API keys and sign-in tokens), remote connection credentials, notification registration information for connected devices, and operational logs. Authentication credentials are saved as files with permissions readable only by the user.
- Crash reports: If the Windows desktop app terminates abnormally, it leaves a crash report (dump) on the PC but does not upload it externally. The Company receives it only if the user sends it directly for troubleshooting.
- Mobile app: List of connected PCs (connection address, PC ID, name, and last used timestamp), setting to hide app update prompts, cryptographic key pair for decrypting notifications (the private key is protected in the iOS Keychain or Android Keystore and never leaves the device), and push token. The camera is used only to scan the QR code on the PC, and photos are neither saved nor transmitted.
- Web app (browser): Connection credentials and settings are stored in browser storage.
8. User Rights and How to Exercise Them
- Users may at any time request access to, correction or deletion of, or suspension of processing of their personal information, or withdraw consent, and the Company acts without delay.
- Disconnecting (unpairing): Unpairing an individual phone or browser, or unregistering the PC itself, under Mixdog Settings → Connection on the PC deletes the corresponding information and notification registration information stored on the relay. In the mobile app, saved PCs can be removed from the list.
- Turning off notification permissions on the phone or browser stops notification delivery.
- Deleting the app also deletes information stored on the device. Information remaining on the relay can be deleted by disconnecting as described above; if you are unable to disconnect directly, please send a request to [email protected].
- Please also send requests to view or delete submitted feedback to [email protected]. Including the feedback receipt number or reply email address helps us verify your request.
- A legal representative or authorized agent may also exercise these rights on the user’s behalf.
9. Security Measures
- End-to-end encryption of remote connection contents (P-256 key exchange and AES-256-GCM) and TLS encryption across all communication channels
- Storing device secrets and access tokens only as hashes, and restricting server secret keys and storage files so that only the server operating account can read them
- Encrypting notification contents on the PC before sending and decrypting them only on the phone
- Preventing abuse through attempt limits on pairing codes, rate limits on registration and connection requests, and an approval process (direct approval on the PC)
- Processing only the minimum necessary information and validating image format and size for feedback attachments
10. Cookies and Similar Identifiers
The web app uses a cookie (mixdog_device) to select the matching UI layout version; users can delete or block cookies in their browser settings. Blocking cookies may cause some screens not to display properly. No advertising identifiers are used.
11. Personal Information of Children Under 14
Mixdog is a tool for developers and is not directed at children under 14, and the Company does not knowingly collect personal information from children under 14 without the consent of a legal representative. If the Company learns that a child’s information has been transmitted, it deletes that information without delay.
12. Destruction of Personal Information
Personal information whose retention period has expired or whose processing purpose has been achieved is destroyed without delay. Electronic files are deleted using methods that prevent recovery.
13. Privacy Inquiries
For inquiries, complaints, or requests for relief regarding personal information processing, please contact us below.
- Email: [email protected]
14. Remedies for Infringement of Rights
If you need to report or consult on a personal information infringement, you may contact the agencies below.
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 without area code (privacy.kisa.or.kr)
- Supreme Prosecutors’ Office: 1301 without area code (www.spo.go.kr)
- National Police Agency: 182 without area code (ecrm.police.go.kr)
15. Changes to This Privacy Policy
If this Privacy Policy is changed due to changes in laws or the Service, the Company will give notice at least 7 days before the effective date. If there is a material change to user rights, such as the items collected, purposes of use, or provision to third parties, the Company will give notice at least 30 days before the effective date.