Eating World privacy policy

Updated 28 October 2026 · Android version 1.0.0

This policy covers Eating World by ZBANI for Android, package com.megavast.eatingworld, and its test package com.megavast.eatingworld.test. The ZBABO website and browser game are separate services.

Operator and contact

MEGAVAST LTD, trading as ZBANI Game Studio. Public support and privacy contact: [email protected].

Information stored locally

Levels, scores and stars remain in app storage. The app stores free play credits, an anonymous paid-wallet identifier and private recovery credential, a cached paid balance and ad-removal status. Wallet credentials and credits are encrypted using Android Keystore. Advertising choices and a protected/older age setting remain on the device; no exact date of birth is requested. Android cloud and device-transfer backup are disabled.

Paid-wallet server

The app creates an anonymous wallet on our HTTPS server. It sends a random wallet ID and authentication credential, round authorization IDs, and Google Play purchase tokens and product identifiers when you purchase. The server stores a hashed authentication secret, purchased credit balance, round debits, purchase tokens, order references, consumption status and refund/revocation records. It uses these to deliver credits, prevent duplicate grants, remove ads after verified payment, restore a wallet using your recovery code and handle refunds. No name, email, precise location or phone number is required to play. The wallet ID is supplied to Google Play as an obfuscated account identifier to bind purchases to the wallet.

Server connections reveal network IP addresses to the hosting infrastructure. The wallet service uses an IP address temporarily for rate limiting and does not log request bodies, tokens or secrets. Apache infrastructure access/security logs can contain IP addresses and request paths. Wallet secrets are sent in authorization headers, never URLs. Paid rounds require internet; unused free credits and an authorized round can be played offline.

Advertising and Google privacy services

If you enable online ads and privacy checks permit requests, Google AdMob and User Messaging Platform process network information such as IP address (which can indicate approximate location), app/ad interactions, diagnostics, and applicable SDK device or app identifiers for ad delivery, measurement, analytics, security and fraud prevention. Non-personalized ads still process data. We do not add our own analytics, social, crash-reporting or mediation SDKs.

Requests use child-directed treatment, G-rated content and non-personalized settings. Under-16 users additionally get under-age-of-consent treatment. The app removes Advertising ID and Android AdServices permissions and disables publisher first-party identifiers before requesting ads. Native ads appear only on the home/levels screen when there is sufficient space. They do not overlap gameplay or purchase/settings dialogs. Verified paid wallets disable ads. Google has its own retention and international processing practices: policies.google.com/privacy and policies.google.com/technologies/partner-sites.

Children and parents

The game includes children in its intended audience. A neutral age range choice configures privacy protections. We do not request a child's contact information. Purchases, wallet management and external support links require a parent or grown-up gate. A parent must also approve Google Play checkout. The game does not contain chat, user-generated content, gambling, cash-out rewards or location tracking.

Your choices

Choose “Play without online ads” at setup or use Home → Ad privacy → Stop online ads on this device. Google privacy choices can be revisited there when required. This stops future requests and does not remove data Google already processed. Network or consent failures do not block remaining free credits or an already authorized round. New paid rounds still require server authorization.

Retention, recovery and deletion

Local game data remains until cleared or uninstalled. Save your private wallet recovery code before purchase; it restores purchased credits and ad-removal status after reinstalling or changing devices. Anyone holding the code can access the wallet. Lost recovery codes can prevent automatic recovery of consumed packs; contact support with a Google order reference, never payment-card data.

Wallet records remain while the wallet is active. In-app wallet deletion invalidates the recovery credential, erases the spendable balance and round history and stops wallet access. Purchase/financial and anti-fraud records may be retained for up to seven years where needed for accounting, refunds, legal obligations or disputes; they are restricted to those purposes. Infrastructure logs are retained for security as needed. Support correspondence is retained while handling the request and relevant obligations. Request access or deletion at [email protected]. Deleting the app does not automatically delete the server wallet or Google's records. See the deletion page for both methods.

Rights and changes

Depending on your location you may have rights of access, correction, erasure, objection, restriction and complaint to a data protection authority. Contact MEGAVAST LTD above. Processing supports the requested game/purchases and security, with consent where required for advertising and legal obligations for financial records. Google may process information internationally under its own safeguards. This policy and the packaged copy will be updated when practices change.