Privacy Policy

1. Advertisers and publishers who sign in

What we hold: the email address, the name and the Google account identifier that Google sends us when you sign in, the language you signed in with, the ads and the apps you register, your credit and every movement on it, and, for a publisher, the earnings booked and the payouts recorded. Card details go to Stripe and never reach us; Stripe’s own privacy policy covers them. Payout details you give us are used for that payout and kept with its record.

Why: to run your account, to show your ads or to pay you, to review ads before they run, to keep accounts and taxes straight, and to write to you when your ad has been decided on or money has been sent. We send those emails through Brevo.

For how long: while your account exists, then as long as tax and accounting law require us to keep the records of money that moved. Everything else goes when the account does; ask at privacy@kbsoap.com.

2. People who see an ad

When an app or a page asks for an ad, the request carries an identifier for that device and the phone’s language. On Android it is the advertising identifier only where the app’s Google Play declaration allows it and the phone has not limited ad tracking; everywhere else, and on the web, it is an identifier our software made for that install or that browser alone, which no other app can read and which is gone when the app is removed or the browser’s storage is cleared. In a browser it lives in the page’s local storage; we set no cookie there.

We never store or log the identifier itself: the server keeps a keyed hash of it, and of the network address the request came from. Those hashes are what let us not show the same ad twice in a row, keep an app’s own pacing rules, count each impression once, and tell people from scripts. They are not used to build a profile of anyone, are not combined with anything else, are not shared with advertisers, and are not sold. Advertisers see counts, never people.

For how long: the record of each impression and tap is kept for thirty-five days, then only daily totals remain; the per-device memory that keeps an ad from repeating is kept for thirty days. Rotating the hashing key erases every device’s history at once, which is also how a deletion request is honoured; the only way to point at a device is the identifier the device itself holds, so resetting it on the phone, or clearing the page’s storage, is the same as deleting it here.

3. Visitors of the public pages

The pages at zaparoads. kbsoap.com set one cookie to remember the language you chose, for a year, and a sign-in cookie for those who sign in, for a week. There are no analytics, no advertising trackers and no third-party scripts on these pages, and no access log: the server holds a caller’s network address in memory only for the minutes it takes to limit how fast one address may call it.

4. Who else touches the data

Google, for sign-in; Stripe, for payments; Brevo, for the emails we send; Oracle Cloud, whose servers in the United States run the network. We fetch the public Google Play page of a registered app to see whether it is listed. Nobody else receives data, and none of it is sold.

The service runs in the United States, and that is where the data is processed. It is not meant for children: a person under thirteen may not open an account, and apps aimed at children are not accepted on the network.

5. Your rights, and contact

You may ask what we hold about you, have it corrected, or have it deleted, at privacy@kbsoap.com; we answer within thirty days. Where the law of your country gives you more, you keep it. This policy changes only here, with its date; a change that matters to signed-in users is announced in the panel.