ZapReels Privacy Policy

Last updated: September 7, 2026

1. Information We Collect

Device & network: stable anonymous installation ID (deviceId), OS/app version, device model, language/locale/tags (including en/es/pt-BR/zh-CN/de/fr/it selection), network type, IP address (as seen by our servers and SDKs), and approximate region.
Advertising IDs: Google Advertising ID (GAID/AAID) or equivalent device-level ad ID, and when opted-in, the ability to attribute an install via that ID.
Usage & content: dramas viewed, watch progress & position, unlock history (unlockIndex), episodes/durations watched, tasks completed, daily check-in dates & streaks, booster quota, diamond balance & pending delta, home/interstitial/feed ad impression counts, rating usage time, splash shown time, and ad interactions.
Purchases & entitlement: Play Billing product IDs (zapreels_weekly, zapreels_monthly, zapreels_booster_5/10/20, zapreels_diamond_5000/10000/30000/50000), purchase token, order signature & JSON, purchase time, billing price micros/currency & pricing phases, subscription expiry, pending-purchase state, and anti-double-spend guards.
Account (if created): user ID, email if provided, profile fields you share. Current builds run anonymous (no email required); data under “account” is the anonymous install ID until you opt into a future login.
Diagnostics: crash traces via Firebase Crashlytics, ad response info & paid-event value micros/precision/currency (AdValue, responseInfo, adSourceName) for ILRD, and heartbeat event queue payloads.
Push: Firebase Cloud Messaging token when you allow notifications, and the data-only push payload (title/body/drama_id/start_ep).
Attribution & referrer: deferred deep-link URL, click IDs, campaign IDs, Play Install Referrer, and Meta install referrer (via Facebook app ID 1431167418901587).

2. How We Collect Information

We collect information: (a) automatically on-device through our SDKs and the App; (b) when you voluntarily provide it (support messages, account creation); (c) from third-party partners (analytics, ads, attribution, Offerwall); (d) via HMAC-signed API calls to our backend (https://hwdj.nqlian.com/ in release, test endpoint in debug) carrying X-Device-Id, X-Ts, X-Nonce, Rapid-Api v2.HMAC-SHA256 headers; (e) via Google Play Billing callbacks and the Google Play Install Referrer API; and (f) via your interaction with the UMP consent form.

3. Third-Party SDKs

The App integrates the following SDKs. Each processes data under its own policy; we encourage you to review them. Data may include GAID, deviceId, IP, locale, purchase tokens, and ad events, shared only to the extent needed for the listed purpose.

Category	SDK / Provider	Purpose	Policy
Analytics	Firebase Analytics (Google)	Usage analytics, event logging	firebase.google.com/policies
Analytics	Firebase Remote Config (Google)	Feature flags: `control_rapid/control_ad/task_config/diamond_config/app_update/subs_pop_config/offerwall_config`	firebase.google.com/policies
Analytics / Attribution	Adjust (app token `2sy17xu2vwu8`)	Install attribution & campaign measurement	adjust.com/terms/privacy
Analytics / Attribution	Tenjin (key gated, placeholder `REPLACE_WITH_TENJIN_API_KEY` when disabled)	Attribution, DMA, subscription vs transaction revenue (ILRD vs purchase)	tenjin.com/privacy
Diagnostics	Firebase Crashlytics (Google)	Stability & crash diagnostics	firebase.google.com/policies
Messaging	Firebase Cloud Messaging (Google)	Push delivery (channel `shortdrama_default`)	firebase.google.com/policies
Advertising (mediation)	Google AdMob 25.4.0	Bidding, waterfall, `ad_impression` / `adPaid` ILRD	policies.google.com/privacy
Advertising	Pangle 6.5.1.2	Mediated via AdMob	pangle.io privacy
Advertising	Liftoff / Vungle 7.7.7	Mediated via AdMob (interstitial/rewarded)	liftoff.io / vungle.com privacy
Advertising	InMobi 11.4.1	Mediated via AdMob	inmobi.com/privacy
Offerwall	Tapjoy / Unity LevelPlay Offerwall 14.8.0	Hosted Coins Offerwall, direct (not mediated)	tapjoy.com/privacy , unity.com/legal/privacy
Payments	Google Play Billing 8.0	Subscriptions & in-app purchases	policies.google.com/privacy
Install	Google Play Install Referrer	Install attribution	policies.google.com/privacy
Attribution helper	Meta Facebook SDK (app ID `1431167418901587`)	Meta Install Referrer decryption for Tenjin	facebook.com/privacy

If Tenjin or ad SDKs are gated by placeholder/unavailability, their instance is null and no data is sent.

4. How We Use Your Information

We use data to: operate the drama catalog & ExoPlayer ViewPager2 player with 3-player LRU pool; compute and track rewards (check-in state machine 7-day, task watch episodes/minutes/ads, diamond ledger pendingDelta + server snapshot, booster quota per-episode); serve and measure ads via eCPM waterfall (control_ad) with slot TTLs (SPLASH 4h, ITS/REWARD/PLAY_BACK 1h, FEED 30m) and feed frequency caps; apply introductory subscription pricing phases and verify entitlement server-side; send best-effort pushes that deep-link to zapreels://drama; detect fraud (clock anti-rollback, in-flight billing guards) and ensure 16 KB page-size compatibility; improve UX and fulfill legal duties; and respond to support.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share data:

With the SDK providers in §3 for their listed purposes (e.g., GAID/IP to AdMob/Pangle/Liftoff/InMobi for bidding; deviceId/purchase token to Google Play; AdValue/responseInfo to Firebase/Tenjin/Adjust for ILRD; Offerwall data to Tapjoy/Unity and its advertisers);
With our backend hwdj.nqlian.com for HMAC-verified API calls;
With law enforcement/regulators when required by law;
In a merger/acquisition/asset sale;
With your consent or at your direction.

Tapjoy is the Offerwall merchant of record for Coins; we do not hold the coin balance locally (only display via getCurrencyBalance).

6. Data Retention

Usage/behavioral data up to 24 months. Aggregated anonymized analytics may be retained indefinitely. Local UserPrefs (deviceId, language, diamond/coach balances, task/check-in history, home-interstitial/feed counts, rating usage) and Room tables (history/favorite/ep_cache/event_queue, schema v3) persist until you clear data/reinstall; a destructive downgrade clears them. Heartbeat WorkManager (15 min) retries the event_queue until uploaded. Offerwall coin balance lives on Tapjoy’s server. Account data is retained until you delete your account or request deletion; we delete/anonymize on verified request subject to legal retention.

7. Consent, Privacy Choices & DMA

The App shows a Google UMP consent form on first launch (where required). Fail-closed: while status is UNKNOWN or DENIED, ad requests are suppressed (ConsentGate.canRequestAds()). Debug builds bypass UNKNOWN→NOT_REQUIRED with a logged override.

When you grant/deny, consent is fanned out to:

Pangle via PAGConsent,
Liftoff/Vungle via VunglePrivacySettings.setGDPRStatus/setCCPAStatus,
InMobi via InMobiPrivacyCompliance.setDoNotSell(!granted),
Tapjoy via TJPrivacyPolicy setUSPrivacy / setBelowConsentAge / setUsageStatsConsent (subjectToGdpr hard-true),
Tenjin via optIn/optOut plus Google DMA setGoogleDMAParameters / optInGoogleDMA / optOutGoogleDMA (we do not call Tenjin’s optInOutUsingCMP — it would override our fail-closed optOut when TCF is empty).

Tenjin connects with a 60s throttle (setConnectInterval(60s)) and reconnects on each onResume; revenue is reported in separate channels: subscriptions via subscription(Purchase, price, currency) (last pricing phase = regular price) and one-time In-App via transaction — iap_purchase events carry no revenue to avoid double-count.

You can withdraw consent by re-showing the UMP form (in-app settings where available) or via system settings; you can also reset GAID, enable “Opt out of Ads Personalization,” disable pushes via Settings → Push or system notification settings, and withhold Offerwall consent (the “Earn Coins” button gates on _connected and shows “loading” if not connected).

8. Children's Privacy

The App is not directed to children under 13 and does not knowingly collect data from them. We tag requests with setTagForUnderAgeOfConsent(false) and take fail-closed steps to avoid showing personalized ads before consent. If we learn a child under 13 has provided data, we will delete it. EEA users under 16 should use the App only with guardian consent.

9. Your Rights

Depending on jurisdiction (EEA GDPR, UK GDPR, Brazil LGPD, California CCPA/CPRA, etc.), you may have the right to: access personal data we hold; correct inaccurate data; delete your data; restrict or object to processing; receive data in portable format; withdraw consent where processing is based on consent; and opt out of sale/share (we do not sell; InMobi setDoNotSell respects your opt-out). To exercise rights, contact nqhl259@gmail.com. We respond within the timeframe required by applicable law.

10. Data Security

We apply reasonable technical and organizational measures: usesCleartextTraffic=false + network_security_config, HMAC-SHA256 request signing (Rapid-Api: v2.<hex>), allowBackup=false, R8 full obfuscation + resource shrinking, 16 KB page-size alignment, and WebView locked down (javaScriptEnabled=false, allowFileAccess=false) for the offline legal docs. No method is 100% secure.

11. International Data Transfers

Your data may be transferred to and processed in countries outside your residence, including the United States and other regions where Google, Adjust, Tenjin, Pangle, Liftoff, InMobi, and Tapjoy/Unity operate. Where required, transfers rely on Standard Contractual Clauses or adequacy decisions.

12. Changes to This Policy

We may update this Policy from time to time. We will notify you of material changes by posting the updated policy within the App (and updating the “Last updated” date above). Your continued use after the effective date constitutes acceptance.

13. Contact Us

If you have questions or concerns about this Policy or our data practices, contact nqhl259@gmail.com. For Terms matters use nqhl259@gmail.com.