Kerala Bus Mod Livery

Kerala Bus Mod Livery
Developer: Kerala App Creators
Effective Date: May 8, 2026 — Last Updated: May 8, 2026

1. Introduction

Kerala Bus Mod Livery ("App," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, who we share it with, and your rights regarding your data.

This policy applies to all users of the Kerala Bus Mod Livery mobile application, available on Google Play. By using the App, you consent to the data practices described in this Privacy Policy. If you do not agree, please do not use the App.

This Privacy Policy should be read alongside our Terms & Conditions.

2. Information We Collect

We collect only the minimum data necessary to provide our services, process purchases, prevent abuse, and deliver advertisements. Below is a complete breakdown of every data type we collect.

2.1 Information You Provide (Account Data)

When you sign in using Google Sign-In, we receive the following from your Google account:

Data	Purpose	Stored Where
Display Name	Show your name in the App UI and account section	Firebase Auth
Email Address	Account identification, purchase support, customer communication	Firebase Auth
Profile Photo URL	Display your profile picture in the navigation drawer	Firebase Auth
Google User ID (UID)	Unique account identifier for all server-side operations	Firebase Auth & Firestore

Note: We do not access your Google contacts, calendar, Drive, or any other Google services beyond basic authentication. We do not store your Google password.

2.2 Information Collected Automatically

a) Device Information

Data	Purpose	Stored Where
Device ID (Android ID)	Device binding security — ensures one active device per account to prevent unauthorised sharing of Premium Passes	Secure cloud database (Firebase)
Device Type & OS	Emulator detection for anti-fraud (Invalid Traffic protection)	Processed in memory only — not stored on servers
Network Interface Names	VPN detection for ad fraud prevention (Invalid Traffic protection)	Processed in memory only — not stored on servers

b) Ad Interaction Data

Data	Purpose	Stored Where
Daily Rewarded Ad Count	Enforce daily ad limit (prevents ad fatigue and policy violations)	Secure cloud database (Firebase)
Last Ad Watch Timestamp	Enforce cooldown period between consecutive ads	Firebase Firestore
Current Date String	Daily limit reset at midnight	Firebase Firestore

c) Purchase Data

Data	Purpose	Stored Where
Purchase Token	Server-side verification via Google Play API, replay attack prevention	Secure cloud database (Firebase)
Product ID	Identify the purchased product	Firebase Firestore
Purchase Timestamp	Audit trail and customer support	Firebase Firestore
Premium Pass Balance	Track remaining premium downloads	Secure cloud database (Firebase) & local cache (on-device only)
Transaction History	Purchase and usage records for customer support and billing disputes	Secure cloud database (Firebase)

d) Local Storage (On-Device Only)

Data	Purpose	Stored Where
Cached Premium Pass Count	Instant UI display on app start without server calls	SharedPreferences (device only)
App Open Ad Last Show Timestamp	Enforce 1-hour cooldown between app open ads	SharedPreferences (device only)
Content Cache (Hive Database)	Offline access to mod listings, metadata version tracking	Hive local database (device only)
Push Notification Token	Receive new content notifications via Firebase Cloud Messaging	Firebase Cloud Messaging

Data stored locally (SharedPreferences, Hive) never leaves your device and is not transmitted to our servers. It is automatically deleted when you uninstall the App.

2.3 Information We Do NOT Collect

We want to be transparent about what we do not collect:

❌ GPS location or precise/approximate location data
❌ Contacts, call logs, or SMS messages
❌ Camera, microphone, or biometric data
❌ Files or photos from your device storage (beyond downloaded mod files)
❌ Browsing history or data from other apps
❌ Payment card numbers, bank account details, or financial information (all billing is handled by Google Play)
❌ Advertising ID for personalised tracking (we use contextual ads only)
❌ Health, fitness, or sensitive personal data

3. How We Use Your Information

We use collected data strictly for the following purposes:

Purpose	Legal Basis
Account authentication and identity verification	Contract performance (providing the service you signed up for)
Delivering and managing Premium Pass purchases	Contract performance
Verifying purchases server-side to prevent fraud	Legitimate interest (fraud prevention)
Enforcing device-binding security (one device per account)	Legitimate interest (preventing unauthorised access)
Enforcing daily ad limits and cooldown periods	Legitimate interest (policy compliance, user experience)
Detecting and preventing Invalid Traffic (IVT) — emulators, VPNs, automated clicks	Legitimate interest (ad fraud prevention)
Providing customer support and resolving billing disputes	Contract performance
Sending push notifications about new content	Consent (device-level notification permission)
Displaying advertisements to support the free app model	Legitimate interest (monetisation of free service)

4. Data Sharing & Third-Party Services

We do not sell, rent, or trade your personal data to any third party for marketing or advertising purposes. We share data only with the following service providers, strictly for operational purposes:

4.1 Google Firebase

Services Used: Firebase Authentication, Cloud Firestore, Cloud Functions, Remote Config, Cloud Messaging
Data Shared: Account information, purchase records, ad statistics, notification tokens
Purpose: Backend infrastructure, authentication, database, serverless functions, push notifications
Privacy Policy: firebase.google.com/support/privacy

4.2 Google Play Billing

Data Shared: Purchase tokens and product IDs (for server-side verification via the Android Publisher API)
Purpose: Processing in-app purchases, verifying payment authenticity, preventing replay attacks
Note: All payment processing (credit card, UPI, etc.) is handled entirely by Google Play. We never receive or store your payment method details.
Privacy Policy: policies.google.com/privacy

4.3 AppLovin MAX (Ad Mediation)

Services Used: Rewarded Ads, Interstitial Ads, App Open Ads
Mediated Networks: Meta Audience Network, Unity Ads, InMobi
Data Shared: AppLovin SDK and its mediated networks may collect device identifiers, IP address, and ad interaction data as described in their respective privacy policies
Purpose: Serving advertisements to support the free app model
Consent: User consent preferences are passed to AppLovin via setHasUserConsent() and setDoNotSell().
Privacy Policies:
- AppLovin: applovin.com/privacy
- Meta: facebook.com/privacy/policy
- Unity Ads: unity.com/legal/privacy-policy
- InMobi: inmobi.com/privacy-policy

4.4 Google Sign-In

Data Shared: OAuth authentication tokens (handled by Google's SDK)
Purpose: User authentication
Privacy Policy: policies.google.com/privacy

No other third parties receive your data. We do not use analytics SDKs (such as Google Analytics or Facebook SDK), crash reporting tools, or any data brokers.

5. Data Retention

We retain your data for the following periods:

Data Type	Retention Period
Account information (name, email, UID)	Until you delete your account or request data deletion
Premium Pass balance & transaction history	Until account deletion (required for billing dispute resolution)
Purchase verification tokens	Retained indefinitely as a fraud prevention measure. Each token is cryptographically unique; retaining them permanently prevents the same purchase from being redeemed multiple times (replay attacks) even if a user deletes and recreates their account.
Ad statistics (daily count, timestamps)	Overwritten daily (only the current day's data is retained)
Device binding (active_device_id)	Until account deletion or admin reset
Local cache (SharedPreferences, Hive)	Until app uninstallation (stored on device only)

6. Data Security

We implement the following measures to protect your data:

Encryption in Transit: All data transmitted between the App and our servers uses TLS/SSL encryption (HTTPS).
Server-Side Security: Firebase Firestore Security Rules enforce strict access controls — users can only read and modify their own data. Premium Pass balances can only be modified by authenticated Cloud Functions, never by the client app directly.
Purchase Verification: All in-app purchases are verified server-side using Google Play's Android Publisher API with cryptographic token validation.
Replay Attack Prevention: Each purchase token is recorded in a server-side database and checked for uniqueness before granting passes, preventing duplicate redemptions.
Device Verification: Server-side device ID validation prevents unauthorised access from unregistered devices.
Anti-Fraud: Invalid Traffic (IVT) protection detects emulators, VPN usage, and suspicious click patterns to prevent ad fraud.

While we implement industry-standard security measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security of your data.

7. Your Rights & Choices

Depending on your jurisdiction, you may have the following rights regarding your personal data:

7.1 Access & Portability

You can view your account information (name, email, pass balance, transaction history) within the App through the My Premium Passes dashboard.

7.2 Data Deletion

You can permanently delete all your data using any of the following methods:

In-App (Instant): Navigate to the App drawer → Delete Account. This immediately and permanently deletes your user data, transaction history, ad statistics, and authentication record from our servers.
Web: Visit our Account Deletion Page and follow the instructions to submit a deletion request. Processed within 30 days.
Email: Send a deletion request to keralaappcreators@gmail.com with the subject line "Data Deletion Request" and your registered email address. Processed within 30 days.

Important: Account deletion is permanent and irreversible. All Premium Passes, purchase history, and associated data will be permanently removed. Unused Premium Passes are non-refundable upon deletion.

7.3 Ad Consent & Tracking

You can opt out of personalised ads through your device Settings → Google → Ads → "Opt out of Ads Personalisation."

7.4 Push Notifications

You can enable or disable push notifications at any time through your device's notification settings for the Kerala Bus Mod Livery app.

7.5 GDPR Rights (European Economic Area)

If you are located in the EEA, you have additional rights under the General Data Protection Regulation (GDPR), including:

Right to access your personal data
Right to rectification of inaccurate data
Right to erasure ("right to be forgotten")
Right to restrict processing
Right to data portability
Right to object to processing

To exercise any of these rights, please contact us at keralaappcreators@gmail.com.

7.6 CCPA Rights (California, USA)

If you are a California resident, you have the right to:

Know what personal information is collected about you
Request deletion of your personal information
Opt out of the sale of your personal information (we do not sell personal information)
Non-discrimination for exercising your privacy rights

8. Children's Privacy

The App is rated "Everyone" on Google Play and is suitable for all age groups. We take children's privacy seriously and comply with theChildren's Online Privacy Protection Act (COPPA) and applicable international regulations.

We do not knowingly collect personal information from children under 13 beyond what is strictly necessary for account authentication (Google Sign-In) and app functionality.
We do not serve interest-based or personalised advertisements. All ads displayed are contextual.
We do not use behavioural targeting, remarketing, or user profiling of any kind.
In-app purchases require authentication through Google Play, which supports parental controls and purchase approval workflows.

Parents & Guardians: If you believe your child has provided personal information beyond the scope described above, please contact us at keralaappcreators@gmail.com. We will promptly investigate and delete any data collected from children in violation of this policy.

9. International Data Transfers

Our backend services are hosted on Google Cloud Platform / Firebase, which may process data in data centres located outside your country of residence. By using the App, you consent to the transfer of your data to these facilities.

Google Cloud complies with internationally recognised data protection frameworks, including the EU-US Data Privacy Framework, to ensure adequate protection of transferred data. For more details, see Google Cloud's GDPR commitments.

10. Cookies & Tracking Technologies

The App itself does not use browser cookies. However, the following local storage mechanisms are used on your device:

SharedPreferences: Stores lightweight key-value pairs (ad cooldown timestamps, cached pass count) locally on your device. This data never leaves your device.
Hive Database: Stores cached content listings locally for offline access. This data never leaves your device.

Third-party SDKs (AppLovin MAX) may use their own tracking technologies as described in their respective privacy policies.

11. App Permissions

The App requests the following Android permissions:

Permission	Purpose
INTERNET	Connect to Firebase servers, download content, serve ads
ACCESS_NETWORK_STATE	Check network availability before making server requests
ACCESS_WIFI_STATE	Network type detection for ad delivery optimisation
POST_NOTIFICATIONS	Send push notifications about new content (requires user permission on Android 13+)
VIBRATE	Haptic feedback for notifications
AD_ID	Advertising identifier used by ad SDKs for ad delivery

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes:

The "Last Updated" date at the top of this page will be revised.
For material changes that significantly affect how we handle your data, we will make reasonable efforts to notify you through the App or via the email associated with your account.
Your continued use of the App after any changes constitutes acceptance of the updated Privacy Policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

General Support: keralaappcreators@gmail.com
Payment & Purchase Issues: payments@keralabusmodlivery.in
Website: keralabusmodlivery.in

For data deletion requests, please contact us at keralaappcreators@gmail.com with the subject line "Data Deletion Request" and your registered email address. We aim to respond to all enquiries within 48 hours and process data deletion requests within 30 days.