Privacy Policy
1 Key Terms
- Application
- Merge Car Master — the mobile game provided by the Company.
- Company
- The organization that operates Merge Car Master and determines the purposes of data processing.
- Personal Data
- Any information that can identify or be linked to a specific individual.
- Usage Data
- Data generated automatically when you play or interact with the app (e.g., session length, in-game events).
- Device
- Any smartphone, tablet, or other hardware used to run Merge Car Master.
- Service Provider
- Third-party vendors or contractors who process data under written agreements on our behalf.
- Account
- A unique profile that grants access to account-specific features and progress.
2 Data We Collect
We collect two categories of data: information generated automatically, and information you provide voluntarily.
Automatically Collected
- IP address, device model, OS version, and browser or runtime info
- Device identifiers — GAID, ANDROID_ID
- Session timestamps, screen interactions, feature usage events
- Crash reports and diagnostic telemetry
- Mobile network details: carrier, connection type, signal strength
Voluntarily Provided
- PayPal email and full name — used exclusively for reward withdrawals
- Support messages and in-app feedback
- Advertising identifiers (GAID / IDFA) — when you permit ad personalization
3 Purpose of Data Processing
Your data powers core functions, communications, and improvements:
| Purpose | Details |
|---|---|
| Service Operation | Run, maintain, and monitor the game and its backend services |
| Account Management | Registration, login, profile preferences, and progress sync |
| Withdrawal Processing | Securely transmit rewards to your PayPal account |
| Customer Support | Respond to questions, bug reports, and account issues |
| Analytics & Improvement | Study usage trends, test features, and resolve performance issues |
| Communications | Send changelogs, maintenance alerts, and promotional updates |
| Legal Compliance | Meet applicable regulatory requirements and enforce our Terms of Service |
| Business Transitions | Support mergers, acquisitions, or corporate restructuring |
5 App Permissions
Merge Car Master requests only permissions essential for gameplay and advertising. No sensitive permissions (camera, microphone, contacts, or precise location) are required.
| Permission | Why It's Needed | Data Accessed |
|---|---|---|
INTERNET | Core game connectivity, ad loading, progress sync | Network status, data transfer metrics |
ACCESS_NETWORK_STATE | Adapt behavior to network conditions (e.g., low-res assets on slow connections) | Connection type and status |
ACCESS_WIFI_STATE | Ensure reliable Wi-Fi operations for large asset downloads | Wi-Fi connectivity status |
AD_ID | Serve personalized ads using a resettable identifier | Advertising ID (resettable anytime) |
VIBRATE | Haptic feedback for merge events and rewards | None |
ACCESS_ADSERVICES_TOPICS | Privacy Sandbox interest-based ad topics | Categorized topic data |
ACCESS_ADSERVICES_ATTRIBUTION | Measure ad campaign effectiveness without cross-app tracking | Attribution signals |
BIND_GET_INSTALL_REFERRER_SERVICE | Attribute app install to the originating ad campaign | Install source, campaign parameters |
BIND_APPHUB_SERVICE | Optimized ad delivery via AppHub pipeline | Ad parameters and impression data |
ACCESS_ADSERVICES_AD_ID | Compliance with latest Android ad service APIs | Ad service identifiers |
FOREGROUND_SERVICE | Maintain critical background reward tasks without interruption | None |
DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION | Secure internal app component communication | None |
6 Server Endpoints & Analytics
Primary Backend
All gameplay, sync, and reward requests are routed through our primary endpoint:
Endpoint: https://vbyb.mcarmaster.com/
Handles: Core gameplay delivery · progress synchronization · reward validation · support routing · anonymized performance monitoring
Security Controls for All Endpoints
In Transit
- TLS 1.2+ mandatory on all connections
- Certificate validation to block interception
- HTTPS-only; plain HTTP rejected
At Rest & Access Control
- Encrypted storage for all personal data
- Role-based access for authorized staff only
- Periodic vulnerability assessments
- DPAs with all third-party processors
7 Advertising Partners
Merge Car Master serves ads through AppLovin and its mediation partner network. Ad partners may receive limited, non-personal technical signals to display relevant ads.
Shared with Partners
- Resettable ad ID (GAID / IDFA)
- Device model, OS, screen size
- Session frequency and duration
- Ad impression and click events
- Country and language locale
Never Shared
- Email address or phone number
- PayPal credentials or financial data
- In-game progress, scores, or inventory
- User-generated content
- Precise GPS location
Partner Privacy Policies
| Ad Network | Privacy Policy URL |
|---|---|
| AppLovin | applovin.com/privacy |
| Google AdMob | policies.google.com/privacy |
| Meta Audience Network | facebook.com/privacy/policy |
| Chartboost | chartboost.com/legal/privacy-policy |
| InMobi | inmobi.com/privacy-policy |
| IronSource | ironsource mobile privacy policy |
| Mintegral | mintegral.com/en/privacy |
| Moloco | moloco.com/privacy-policy |
| Bytedance / Pangle | pangleglobal.com/privacy |
| Vungle / Liftoff | vungle.com/privacy |
| Unity Ads | unity3d.com/legal/privacy-policy |
| Fyber | fyber.com/privacy-policy |
| BidMachine | bidmachine.io/docs |
| Verve Group | verve.com/privacy-policy |
| Bigo Ads | bigo.tv/policy |
| Yandex | yandex.com/legal/confidential |
| Kwai For Business | kwai.com/legal |
8 Your Privacy Rights
Multiple data protection frameworks protect you depending on your location. To exercise any right, email garrettetirasuthma500@gmail.com.
CCPA / CPRA
- Know what data is collected
- Delete personal information
- Opt out of data sales
- Correct inaccurate data
- No discriminatory treatment
GDPR
- Access your data
- Rectify inaccuracies
- Request erasure
- Restrict processing
- Object to processing
VCDPA
- Access & confirm processing
- Correct inaccuracies
- Delete personal data
- Obtain portable copy
- Opt out of targeted ads
We will acknowledge your request within 10 business days and complete it within the timeframe required by applicable law.
9 How to Opt Out
Ad Personalization
- Android: Settings → Google → Ads → "Opt out of Ads Personalization"
- iOS 14+: Settings → Privacy & Security → Tracking → disable for Merge Car Master
- You can also reset your Advertising ID at any time via the same menus above
Do Not Sell My Personal Information
Email garrettetirasuthma500@gmail.com with subject line "Do Not Sell". We will process your request within 15 business days and confirm once complete.
Profiling
We do not engage in profiling that produces legal or similarly significant effects on individual users.
10 Security Measures
Industry-standard protections are in place across all systems:
- TLS 1.2+ encryption for all data in transit between client and server
- Encryption at rest for all stored personal information
- Role-based access controls — only authorized personnel can access personal data
- Scheduled vulnerability assessments and penetration testing
- Contractual security requirements for all service providers
- Incident response procedures with defined escalation paths
While we apply commercially reasonable safeguards, no electronic system is fully immune to risk. We cannot guarantee absolute security of your data.
11 How Long We Keep Your Data
Retention follows the principle of necessity — we keep data only as long as required:
- Active accounts: Personal data retained for the duration of your account plus any legally mandated period
- Inactive accounts: Personal data is automatically deleted after 90 consecutive days of inactivity
- Usage & analytics data: Retained only in anonymized or aggregated form for performance analysis; no retention limit applies
- PayPal transaction records: Kept for up to 7 years to satisfy financial and tax compliance obligations
- Support logs: Retained for up to 2 years from case closure
12 Children's Privacy
Merge Car Master is not designed for or directed at children under the age of 13. We do not knowingly solicit or collect personal data from users under 13.
If you are a parent or guardian and believe your child has provided personal information to us, please contact garrettetirasuthma500@gmail.com. We will investigate and delete any such data promptly.
13 Cross-Border Data Transfers
Your data may be transferred to and processed on servers located in countries other than your own. We ensure adequate protection through:
- Standard Contractual Clauses (SCCs) for transfers from the EEA
- TLS 1.2+ encryption applied to all international data flows
- Data Processing Agreements with all overseas processors
- Compliance with applicable international transfer frameworks and adequacy decisions
14 Third-Party Links
Merge Car Master may include links to external websites, services, or content not operated by us. We are not responsible for the privacy practices or content of those external destinations. We encourage you to review the privacy policy of any third-party service before sharing personal information with them.
15 California Shine the Light
California Civil Code Section 1798.83 ("Shine the Light") permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes.
Merge Car Master does not disclose personal information to third parties for their direct marketing purposes without your prior consent. To confirm this or to ask questions, contact us at garrettetirasuthma500@gmail.com with the subject line "Shine the Light Request".
16 Do Not Track Signals
Some browsers and mobile operating systems include a Do Not Track ("DNT") feature that signals your preference not to be tracked across apps and websites. Because there is currently no uniform standard for how apps should respond to DNT signals, Merge Car Master does not alter its data collection or use practices in response to DNT signals at this time.
You can still limit tracking through the opt-out mechanisms described in Section 9 above.
17 Policy Amendments
- We may revise this policy periodically as our services and legal obligations evolve
- The revised version will be posted on this page with an updated Effective Date
- For material changes, we will notify you via email to the address on file or via a prominent in-app notice at least 7 days before changes take effect
- Continued use of Merge Car Master after the effective date constitutes acceptance of the updated policy
18 Get in Touch
Privacy inquiries, rights requests, and data deletion questions are all welcome. We're committed to responding promptly.
Email: garrettetirasuthma500@gmail.com
In-App: Settings → Help & Support
Merge Car Master — Committed to transparent and responsible data practices.