Pandadoku Privacy Policy

  • Effective date: August 21, 2026
  • Last updated: September 14, 2026
  • Developer/data controller: Shanghai Shiguang Box Technology Co., Ltd
  • Brand: Yaha Games
  • Privacy contact: [email protected]
  • Public policy URL: https://yaha.games/pandadoku/privacy-policy
  • App/version/package: Pandadoku 1.12.1 / com.lightbox.pandadoku.game

1. Introduction

Shanghai Shiguang Box Technology Co., Ltd, operating the Yaha Games brand ("we", "us", or "our"), provides the Pandadoku mobile application (the "Service"). This Privacy Policy explains what information the Service processes, why it is processed, how it may be shared, and the choices available to users. It applies to the ad-supported Pandadoku release identified above and does not describe unrelated games or the advertising behavior of the Yaha website.

2. Information we process

Data stored only on the device

Pandadoku stores game progress, settings, tutorial state, local ranking state, and privacy choices on the user's device. We do not receive this local game data. Android backup is disabled. Users can remove the data by clearing the app's storage or uninstalling the app.

Optional Firebase Analytics

Pandadoku includes Firebase Analytics. Analytics collection and related Consent Mode signals are disabled by default. Only after a user actively enables “Experience Analytics” may Firebase Analytics collect or receive:

  • app interactions and gameplay events, such as screen views, level starts, level results, and feature use;
  • diagnostics and performance information, such as crash-related or error information where available;
  • basic app and device information, such as app version, device model, operating-system version, and language;
  • IP address, which may be used to derive approximate location; and
  • a Firebase installation, app-instance, device, or other identifier used to provide and measure analytics.

We use optional analytics to understand app stability and gameplay behavior. We do not use Pandadoku analytics for cross-app advertising.

Advertising and consent management

Pandadoku includes Google Mobile Ads SDK 25.4.0 to display and measure ads and Google User Messaging Platform (UMP) SDK 4.0.0 to request, record, and apply privacy and consent choices where required. UMP may process consent status, available privacy options, and technical request information needed to determine which privacy message applies. When advertising is available, Google Mobile Ads may collect, process, and share with Google:

  • IP address and approximate location derived from IP address;
  • app interactions, including ad impressions, ad views, ad clicks, and related engagement events;
  • diagnostics and performance information, including crash or error data;
  • device information, such as device model, operating-system version, language, network information, and app version; and
  • advertising identifiers, device identifiers, app-instance identifiers, or other IDs where available and permitted.

This information may be used to deliver ads, select or personalize ads when the user has consented or applicable law otherwise permits, limit ad frequency, measure advertising and app performance, perform analytics, and prevent fraud, abuse, and security threats. Consent status, region, device settings, and Google's ad-serving rules can affect which data is processed and whether ads are personalized or non-personalized.

Information users provide voluntarily

The in-app feedback screen only displays an on-device confirmation and does not transmit its category or message. If a user contacts us by email, we receive the email address, message, and any information the user chooses to include so that we can respond.

Pandadoku does not create user accounts and does not process in-app purchases or payment information in this release.

3. How we use information

We use information processed through the Service to:

  • operate, maintain, troubleshoot, and improve Pandadoku;
  • provide optional analytics after the user enables Experience Analytics;
  • display, select, limit, and measure advertising;
  • remember and apply privacy and consent choices;
  • understand app interactions, gameplay, stability, and performance;
  • detect and prevent fraud, abuse, invalid ad activity, and security incidents;
  • respond to privacy and support requests; and
  • comply with legal, regulatory, and contractual obligations.

4. Collection, sharing, and service providers

We do not sell personal information. Information described above may be collected by the Service and shared with Google as our analytics, advertising, consent-management, platform, and security service provider. Google and its subprocessors may process information under their applicable terms, privacy notices, consent choices, and legal obligations.

Firebase Analytics, Google Mobile Ads SDK 25.4.0, and UMP SDK 4.0.0 may transmit information directly from the user's device to Google. Google explains how it uses information from apps that use its services at https://policies.google.com/technologies/partner-sites and describes its privacy practices at https://policies.google.com/privacy.

Play In-App Review opens a Google Play controlled flow. Information handled by Google Play in that flow is governed by the user's relationship with Google and is not received through Pandadoku analytics.

We may also disclose information when required by law or when reasonably necessary to protect users, our rights, or the security and integrity of the Service.

5. Retention and security

Local game data remains on the device until it is cleared or the app is uninstalled. Analytics, advertising, consent, and diagnostic information is retained according to the settings, policies, and legal obligations of the applicable Google service and our legitimate operational needs. Support emails are retained only as reasonably necessary to respond, keep appropriate business records, and comply with law.

Information transmitted by the Service is encrypted in transit using HTTPS or comparable transport encryption. We use reasonable administrative and technical safeguards, but no network transmission or storage method can be guaranteed to be completely secure.

6. User privacy choices and requests

Where required, UMP presents privacy choices before advertising data is used for personalized advertising. Users can revisit available advertising privacy choices from the in-app privacy settings. Device or Google settings may also allow users to reset or delete an advertising identifier, limit ad personalization, or manage other privacy controls.

Users may leave Experience Analytics disabled or turn it off at any time in Settings > Privacy. Turning it off stops future optional analytics collection governed by that setting; it does not undo processing already completed and does not disable processing required to deliver, measure, secure, or prevent fraud in advertising.

Users may request access to or deletion of information associated with a support request or an identifiable analytics, advertising, consent, or diagnostic record by emailing [email protected] with enough app and device details for us to evaluate and route the request. Some information is controlled directly by Google or the device platform; where applicable, we will direct the user to the relevant provider or privacy control. We may retain information when required by law or for security, fraud-prevention, or legal-claim purposes.

No account-deletion flow is required because Pandadoku does not create user accounts.

7. Children's privacy

Pandadoku is intended for users aged 16 and older and is not directed to children under 16. We do not knowingly collect personal information from children under 16. If a parent or guardian believes a child has provided information to us, please contact [email protected] so that we can investigate and delete it where required.

8. Changes

We may update this policy when the Service, SDKs, advertising or analytics practices, or legal requirements change. We will post the updated policy at the public URL above and revise the effective or last-updated date. Material changes will also be reflected in the app, consent flow, and Google Play Data Safety declaration where required.

9. Contact