Privacy Policy

01Who we are and what this policy covers

Hajwala Tarat (هجولة طارات) is a mobile online car and drift game by MipZero. The controller responsible for your personal data is [PLACEHOLDER: legal entity name], at Amman, Jordan ("we", "us", "our"). Contact: contact@mipzero.com.

This policy covers the game and its related account, purchase, communication and safety functions. The app identifier on Android and iOS is com.mipzero.mz00. Android launches first; references to iOS and Apple App Store features apply when that version is available.

Our website is MipZero. Visit the game page, Privacy Policy and Terms of Use. We respect applicable data protection laws, including Saudi Arabia's Personal Data Protection Law (PDPL) for processing within its scope. Other mandatory protections may apply where you live.

02Where data comes from and your choices

We receive data from you, your device and use of the game, other players' interactions and reports, and the service providers in section 4.

You can start with an anonymous account and optionally link Google or Apple. "Anonymous" means no linked sign-in account is required; your game account still has an identifier and associated data. It does not mean that your activity cannot be linked to you. Account creation follows the age check and, for teens, one-time guardian email approval in section 11. The limited offline mode described there does not require an online account.

Account and connection data needed for online play is necessary to provide that service. Without it, the affected features cannot work. Linking an account, chatting, using friends, buying items and enabling optional notifications are choices; each feature needs the relevant data to work. Refusing optional analytics, advertising personalisation or promotional notifications does not prevent core gameplay.

03Data, purposes and legal bases

We use the following bases for the purposes below. Agreement means processing necessary to carry out the Terms you have accepted or a purchase you request, including a prior agreement under the Saudi PDPL. Legitimate interests means necessary, proportionate processing for security, integrity and essential diagnostics, after assessing its effect on your rights; under the PDPL, this basis excludes sensitive data. Legal obligation means an applicable duty, such as responding to rights requests or keeping required tax records. Consent means a separate choice for a specified purpose that you can withdraw. Accepting the Terms is not consent to optional processing. If local law requires consent for an activity otherwise listed under another basis, we obtain it before that activity. In Saudi Arabia, using personal data for marketing requires consent.

Please do not include sensitive information, such as health details or identity documents, in chat or reports. We remove or redact unnecessary sensitive information. If such information must be processed, we use explicit consent or another basis specifically permitted by law, rather than legitimate interests.

Manage optional Analytics (usage data) in Settings → Privacy; for teens, this choice is set by the guardian.

Nescie Game Services provides game analytics, performance and crash-data functions. The game's Firebase Cloud Messaging integration uses the push token only for notification delivery.

04Service providers and other recipients

The services below receive relevant data for their functions. Providers processing data on our behalf act under our instructions and data-protection terms; services processing data for their own account, store, billing or advertising purposes act under their own applicable policies. A provider's role depends on the activity. We remain responsible for processing under our control.

Ads use Google AdMob (Google), with mediation partners AppLovin, Unity Ads and ironSource (ironSource is part of Unity). These are independent advertising providers with separate policies, so a single privacy-policy URL cannot cover them all; provider-specific links are listed below.

Other players can see relevant nicknames and gameplay information in rooms, friends features and leaderboards. Room participants can see the messages you send. People handling reports may see relevant content and account information. Avoid sharing private information through these features.

We may disclose relevant data to authorities or other authorised recipients when required by law or lawfully necessary for fraud prevention, safety or legal claims. Disclosure is limited to the relevant purpose and an applicable legal basis.

05Chat, reports and moderation

The game includes text and quick chat in multiplayer rooms. Messages may be stored and reviewed with reports and relevant account/gameplay information to investigate abuse, enforce the rules and protect players. Not every message is reviewed in real time, and we cannot guarantee prevention of every harmful message.

Use the player-reporting feature or contact@mipzero.com to report a problem or ask for review of a moderation decision. Warnings, restrictions, suspensions or bans may follow a review. Retention limits are in section 9.

06Advertising and privacy choices

The game shows banner, interstitial (full-screen) and rewarded video ads. Ads are served by Google AdMob, which works with these ad partners: AppLovin, Unity Ads and ironSource. Players aged 18 or older see personalised ads only if they agree, and can change this any time in Settings → Privacy. Players under 18 always get non-personalised ads with age-appropriate content (rated up to Teen), and their data is not used for interest-based advertising. Ad partners may use the device's advertising ID and IP address to deliver ads, measure them, limit how often they repeat, and prevent fraud. Remove ads (an in-app purchase, also included in VIP) turns off banner and interstitial ads; rewarded ads stay, because the player chooses to watch them.

ironSource is part of Unity. Each provider may collect device/advertising identifiers and ad-interaction data under its own policy, consistent with the choices below. Depending on configuration and those choices, this may include device information, IP address, Android Advertising ID and, when iOS is available, IDFA. No ad is requested before the age band and applicable privacy choices are known. There are several independent providers, so no single privacy-policy URL covers them all:

• Google (AdMob): Privacy Policy and How Google uses information from sites or apps that use our services.
• AppLovin: Privacy Policy.
• Unity Ads and ironSource (Unity): Game Player and App User Privacy Policy; Unity's general Privacy Policy.

Settings → Privacy contains Personalised ads, Analytics (usage data) and Promotional notifications. All are off until the player opts in, with separate consent for each purpose. Personalised ads are for adults only and always off for players under 18; we do not enable tracking or show Apple's App Tracking Transparency (ATT) prompt to teens. For teens, Analytics and Promotional notifications are set by the guardian and remain off until the guardian opts in. Use these controls to give, refuse or withdraw consent as easily as you gave it.

For adults, Google's consent form is shown where Google requires it: the European Economic Area (EEA), United Kingdom (UK), Switzerland and US states with privacy laws. In the EEA, UK and Switzerland, Google's consent message asks for your choice first. Google's Privacy options entry appears in Settings → Privacy where Google requires it in those regions. Adults outside those regions see a one-time personalised-ads card with Yes and No given equal weight; No is the default. We do not show this card in addition to Google's form.

Withdrawing consent stops the relevant future processing without undue delay and does not affect the lawfulness of earlier processing. When personalised ads are off, any ads shown are non-personalised and are served only where lawful; refusing consent does not authorise other advertising uses of your personal data. Changes to advertising choices apply from the next ad request.

Device privacy settings provide additional controls, including available Android Advertising ID options. On iOS, Apple's ATT prompt follows only after an adult chooses Yes to personalised ads, and before any tracking or IDFA access that requires that permission. You may refuse or change that permission in device settings. Device permission does not replace separate consent required by law.

07Push notifications and game controllers

Nescie Game Services supports notification campaigns, delivered through Firebase Cloud Messaging using the push token. Promotional notifications in Settings → Privacy are off until opt-in; for teens, the guardian sets this choice. Turning them on may ask for the device's notification permission if needed; turning them off withdraws promotional consent. You can also withdraw that consent by contacting contact@mipzero.com. Device permission alone is not promotional consent. You can turn off notifications in your device's notification settings for the game. Turning off notifications does not delete your account.

You may use supported optional game controllers. Gameplay resulting from controller input is processed like other gameplay as described in section 3.

08International processing and transfers

Our providers may process data outside your country, including outside Saudi Arabia, for the functions described above. We limit transfers to what is necessary for those purposes. Before transferring Saudi-protected data, we meet the PDPL and transfer-regulation conditions, including required risk assessments and an applicable transfer route, such as a recognised adequate level of protection or SDAIA standard contractual clauses where permitted. We suspend a transfer if its required protections cannot be maintained. Equivalent requirements apply under other applicable laws.

Contact contact@mipzero.com for information about the destinations, recipients and safeguards applicable to your data, including an explanation or copy of safeguards where the law permits.

09Retention

We delete data or irreversibly anonymise it when it is no longer needed. The following are maximum ordinary periods, not reasons to keep unnecessary data. Account deletion and valid erasure requests may shorten them. Only the specific exceptions below permit longer retention.

If a specific law, court order or lawful legal hold requires longer preservation, we retain only the necessary records, restrict their use to that purpose and delete them when that requirement ends. After account deletion, optional safety retention applies only where lawful; otherwise the data is deleted. Independently operated stores retain their own records under their policies and legal duties.

10Security

We use reasonable technical and organisational safeguards appropriate to the data and risks. These include access controls that limit personal-data access to authorised people who need it, confidentiality duties, security updates and procedures for handling security incidents.

No online service can guarantee absolute security. Keep your device and linked accounts secure. If a personal data breach occurs, we assess it and notify affected people and authorities where required by law.

11Children, minimum age and ratings

You must be at least 13 to use the game, and meet any higher age restriction required by local law or shown on your local store listing. Players under 13 cannot use the game: no account is created and no ads are requested. Guardian permission does not override this rule; there is no guardian approval route for them.

Eligible players aged 13–17 may play offline in a limited mode while waiting for a parent or legal guardian's one-time approval by email. This mode has no online play, no chat and no purchases. Guardian approval is required before online play, chat and purchases. Purchases also go through the app store's own parental controls (Google Play, and Apple App Store once iOS is available), which the parent or guardian can set up.

Check the content rating on Google Play and, once released, the App Store in your country. Ratings can differ by store and region; they do not replace the age and guardian requirements in this policy and the Terms.

The age question is asked once at first launch, before an account exists. Only the age band is stored: under 13, 13–17 or 18+; we never store a birth date. The band is stored locally and in the account once an account exists. It cannot be changed in the game. To correct a wrong answer, use Contact us at contact@mipzero.com.

For eligible teens, we request a guardian's email address, send a confirmation request and make proportionate checks of the guardian's identity and authority before online play, chat and purchases. The guardian approves those features and separately sets Analytics and Promotional notifications, which remain off until the guardian opts in. Teens never receive personalised ads; tracking is disabled and no ATT prompt is shown. We keep the age band and approval record; extra verification information is requested only if necessary, and identity documents are not requested by default.

If we discover an ineligible account, we restrict it and delete its data, apart from any limited retention required by law. If required guardian approval is missing or withdrawn, eligible teens remain limited to offline play without online play, chat or purchases. We stop the affected use and processing, and obtain valid approval or delete the affected data. A guardian can request review, withdraw permission or request deletion at contact@mipzero.com.

12Your rights and data requests

Under applicable law, your rights may include being informed about processing; accessing and receiving a readable copy of your data; correcting or completing it; requesting deletion; and withdrawing consent. Where the law provides them, you may also object to processing, restrict it or request portable data. These rights have legal conditions and exceptions.

Send requests to contact@mipzero.com. We verify your connection to the account using only proportionate information. We respond and act on valid requests within 30 days of receipt, or sooner where required. If the applicable law allows an extension, we explain the reason and new deadline before the initial period ends; under the Saudi PDPL this is no more than 30 additional days for permitted reasons. We explain any lawful refusal or restriction. Section 13 explains immediate in-app deletion, verified email requests and backup removal; the general deadline above also applies to email deletion requests.

You may complain to the competent authority, including through the Saudi personal data protection portal for Saudi PDPL matters, and seek available legal remedies. Contacting us first is optional.

13Account deletion

Use Profile → Account → Delete account, review the consequences and confirm your request by typing DELETE (حذف in Arabic) in the game. This route covers anonymous and linked accounts. You can also request deletion without reinstalling the game by emailing contact@mipzero.com; these instructions are available at the Hajwala Tarat privacy page. Provide your account ID if available and enough information to locate the account; never send a Google or Apple password.

If the device is offline, nothing is sent. The game tells you to try again when connected or email contact@mipzero.com.

In-app deletion erases your game account and its game data from the server right away after you confirm it. Email deletion requests are carried out once we have verified the account is yours; the general rights-response deadline in section 12 still applies to these requests. Deleted data is purged from backups within 30 days of deletion, or sooner if law requires. We confirm completion and explain any specific records lawfully retained under section 9, their purpose and retention period.

Deletion removes your game account and its game data: profile, cloud save/progress, friends links, balances, item entitlements and leaderboard association. Associated chat, analytics and other personal data linked to the game account is deleted or irreversibly anonymised, apart from the limited exceptions in section 9 and the device sign-in identifier described below. Retained records do not keep your game account active. After deletion, the local save and the age band are cleared, and the game starts as a new player.

In-app deletion does not erase your cross-game login identity: a device-based sign-in identifier that our backend provider, Nescie Game Services, keeps to operate sign-in across games. After deletion, the same phone signs in again as a new player with an empty game account. To have this device sign-in identifier removed, email contact@mipzero.com; it is removed within the rights-response deadline in section 12.

Uninstalling the app or unlinking a sign-in provider does not itself delete the account. Deletion may permanently end access to progress, purchased items and unused currency. It is not automatically a refund request and does not remove mandatory refund or other consumer rights. Refunds follow applicable law and store policy.

Deleting the game account does not delete your Google/Apple account or records an independent provider lawfully keeps for its own purposes. Other players may keep copies of messages they received; we cannot remove copies outside our control.

14Changes and language versions

We may update this policy when the game or our data practices change. We publish the revised policy with its effective date and notify you of material changes in the game or by another appropriate method. We obtain fresh consent before a new consent-based use where required; continued play alone is not that consent.

The Arabic version controls if the versions differ; the English version is a translation. This does not limit mandatory rights or legally required local-language protections.

15Contact

For privacy questions, data requests, account deletion or concerns about a child's data:

• Controller: [PLACEHOLDER: legal entity name]
• Registered address: Amman, Jordan
• Email: contact@mipzero.com
• Website: MipZero