English

Zaparo WingRush: Privacy Policy

Last updated 2026-10-02.

Zaparo WingRush collects the following, and nothing else.

What	Specifically	Why	Shared
App activity	A score this user submitted to an app-defined board, when they achieved it, and an optional opaque proof string the app supplies - keyed on their Zaparo ID user id; App interactions, as AdMob measures them: that an ad was requested, shown, watched or dismissed; Level, experience points and the number of races played; Link token opened, and the Play install referrer used to match a deferred link after install; Race results: pipes passed, how long the run lasted, and the tap timings the run is verified from; The message payloads, opaque to this module and relayed rather than stored; Which applications within this one tenant the account has been seen in. Recorded when an application registers a device or completes a sign-in under its own application id, so `me().apps` can answer it back to the person.; Who a signed-in user is friends with, who they have a pending request with, and the short code they hand out - all keyed on their Zaparo ID user id	Account management, Advertising or marketing, Analytics, App functionality, Fraud prevention, security, and compliance	Yes
App info and performance	App sessions, as Firebase Sessions reports them to Crashlytics: when the app came to the foreground and started a session, with the package name, OS and SDK versions, network type, and device manufacturer and model; Crash stack traces, ANRs and breadcrumbs; Diagnostics the SDK reports on the app and on itself: app launch time, hang rate and energy usage	Advertising or marketing, Analytics, Fraud prevention, security, and compliance	Yes
Device or other IDs	Advertising ID (AD_ID), used by AdMob to serve and measure ads; An identifier for the phone, sent with an ad request and with the report that an ad was shown or tapped. It is the advertising identifier only where the app has been declared for it in Play; everywhere else it is an identifier this SDK generates for that install alone, which no other app can read and which dies when the app is removed. Neither is stored as it arrives: the server keeps a keyed hash of it, so the ads cannot be traced back to the identifier.; Crashlytics installation UUID; FCM registration token; Firebase installation ID, from the Firebase Installations SDK that Crashlytics brings in; it is sent with each app session and used to renew the Crashlytics installation UUID; The account identifier, the public half of a key generated in the device key store, and what registered it: the kind of client (phone app, browser, desktop app), its operating system and the app version; The caller's user id, carried on each message so the other players know who sent it	Account management, Advertising or marketing, Analytics, App functionality, Fraud prevention, security, and compliance	Yes
Location	Approximate location, derived by AdMob from the IP address an ad request arrives on	Advertising or marketing, Analytics, Fraud prevention, security, and compliance	Yes
Personal info	Display name - generated by default, editable by the user; Email address, and the name a provider reported, from the sign-in the person chose. Those two and nothing else: a browser provider is asked for `openid email profile` and only the address and the name are read out of what comes back.	Account management, App functionality, Personalization	No
Photos and videos	Profile photo the user chose to upload	App functionality, Personalization	No

How long your data is kept

Who holds each kind of data listed above, and when it is deleted:

App activity: Race results, tap logs and skill counters stay on our servers until your account is deleted. The same deletion removes your runs from the pool of opponents, and finished races stay without your name on them. The notification token stays until your phone unregisters it or your account is deleted.
App activity, Device or other IDs, Personal info: Zaparo ID, our sign-in service, keeps it for as long as your Zaparo ID exists. Your Zaparo ID is shared by every Zaparo app you use, so deleting your data in one app removes only that app's link to it.
App activity: On our servers, until your account is deleted or the app removes the leaderboard.
App activity: On our servers, until your account is deleted. Friendships and friend codes do not belong to one app, so deleting them removes them from every app that used them.
Personal info, Photos and videos: On our servers, profile pictures included. A picture you replace is moved to separate storage that is not backed up. When you delete your profile, or a moderator removes something, it is really deleted. Taking part in a live session is kept as one hashed key per person, valid only in that app, which expires after at most 30 days and is deleted when you leave, when it expires, or with your profile.
App activity, Device or other IDs: Held in our servers' memory for at most five minutes, and only so a player whose connection dropped can be sent what they missed. Nothing is written to disk, so there is nothing here for an account deletion to remove.
Device or other IDs: The notification token stays on our servers until your phone unregisters it or your account is deleted.
App activity: On our servers. A link's record stays until the link expires, is revoked, or the account that made it deletes its data; nothing else is kept.
Device or other IDs: Our ad server keeps each ad view and tap for 35 days, linked only to a one-way code made from the device identifier with a secret key (a keyed hash), never to the identifier itself. Then that whole day's records are deleted, and the totals that remain identify no phone. A record of which ads a phone has already been shown is kept for 30 days, so the same ad is not shown to it again.
App info and performance, Device or other IDs: Google (Firebase Crashlytics) keeps crash reports, minidumps (snapshots of memory at the moment of a crash), the installation IDs and the session data sent with them for 90 days, then removes them from its live and backup systems. We keep none of it on our own servers.
App activity, App info and performance, Device or other IDs, Location: Google holds it under its own retention rules for advertising data, published at policies.google.com/technologies/retention. You can reset or delete the advertising ID at any time in your phone's settings.

Deleting your data

You can ask for your data to be deleted at any time, at the address below.

Email privacy@kbsoap.com with the subject “Delete my data” and the app's name, Zaparo WingRush.
If you signed in, send it from the email address you signed in with, or write that address in the message, so the request can be matched to your account.
Your data in Zaparo WingRush listed above is deleted within 30 days of your request, except what the list above says is kept, for as long as it says.
Your Zaparo ID is shared by every Zaparo app you use, so it is not deleted: only its link to Zaparo WingRush is removed, and your data in other Zaparo apps stays.

Contact

Questions about this policy, or a deletion request: privacy@kbsoap.com