============================================================

Kangkoong Games · Member Area

Privacy Policy

Your account, your progress, and your choices.

Last updated: 22 October 2026

This policy covers all games operated by Kangkoong Games and Kangkoong Member Area at member.kangkoong.com. Your Kangkoong account is shared between the website and connected games. Data processing depends on the features you use. The Our Garage section below describes its current build; a feature described for one game is not automatically active in another. We will add game-specific disclosures before introducing different data practices.

Questions or requests about your data go directly to our private privacy request form (https://member.kangkoong.com/privacy/contact?lang=en) . You can read this policy and start an account deletion request without installing the game.

Delete my account (https://member.kangkoong.com/delete-account?lang=en) Contact about my data (https://member.kangkoong.com/privacy/contact?lang=en) 

Our Garage: Retro Racing

Android internal testing version 0.4.2 (version code 6). This section describes that build, not planned features or every Kangkoong game.

- Account: the game requires a Kangkoong account. Email, Google, and Kangkoong sign-in options depend on the account service and provider configuration. A visible button does not guarantee that a provider is available. Sign-in processes identity and session data; it does not read Gmail messages.
- Local gameplay: vehicles, tuning, race results, licenses, Story progress, daily rewards, race items, energy, balances, and settings are saved on your device under your account identifier. This build does not provide general cloud-save synchronization. Losing device data may lose progress.
- Ads and purchases: the AdMob SDK is omitted and rewarded ads are disabled. Google Play purchases are disabled; the presence of the Unity IAP package is not an active checkout. No ad viewing or paid top-up is available in this build. Gold is earned through gameplay. Diamond and KANG labels do not imply that purchasing, blockchain transfers, cash-out, or trading are active.
- Online features: this build does not offer an operational global leaderboard or online multiplayer service. Local race results are not automatically published to a global leaderboard.
- Permissions and deletion: racing and sign-in do not request microphone, camera, address-book, or precise GPS access. Privacy and account deletion links open the Member Area website. The shared account deletion scope and local-device limitations below apply.

Online account functions require the Member Area backend to be available. We will update this section and relevant in-app notices before activating additional data processing.

1. Information we handle

- Account information: your display name, email address, account identifier, verification status, and sign-in method. For email/password accounts, our server stores a password hash, not a readable password. Google sign-in supplies your basic profile, verified email, and Google account identifier. It does not give us access to your Gmail messages or contacts.
- Sign-in and security information: session cookies, temporary authorization codes, session/token records, and request information such as IP address, browser type, timestamps, and errors. These support sign-in, abuse prevention, and troubleshooting.
- Game information: profile identifiers, settings, progress, inventory, results, and rewards needed by the game you use. Storage and online sharing vary by game; see the specific section below. Member Area stores game membership and recorded activity when you join or open a connected game.
- Wallet and purchase information, when used: KANG transfer records and balances; Diamond, premium fuel and energy balances; product and order identifiers; purchase verification tokens; and reward/grant records. Google Play handles payment details. Our game and member service do not ask for or store your full payment-card number.
- Privacy requests: the contact address, request type, and message you choose to send, plus a request reference and handling status. Please do not include passwords, payment-card details, or identification documents in the form.

A feature that needs additional device permissions will explain its purpose in the relevant game. This general policy does not grant permission to access your device. See the current Our Garage permissions below.

2. How we use information

We use account and game information to create and secure your account, connect the game to the website, provide gameplay and rewards, maintain balances, verify purchases, prevent duplicate or fraudulent grants, respond to requests, and resolve service problems. Necessary website cookies keep you signed in and protect forms against unauthorized submissions.

We do not sell your account profile or privacy-request messages. Access is limited to operating these services, handling support, and meeting applicable legal requirements. We may provide information when required by a valid legal process.

3. Services we work with

The services below process information only when the relevant integration is enabled and used; their inclusion here does not mean every game sends data to them. Availability can vary by game version, platform, and configuration.

- Google sign-in and Firebase Authentication: authentication and account verification. We request basic sign-in information, not access to your mailbox. See Google's privacy policy (https://policies.google.com/privacy)  and Firebase privacy information (https://firebase.google.com/support/privacy) .
- Google Play and Unity In-App Purchasing: purchase processing, product prices, receipt validation, delivery, and purchase diagnostics when in-app purchases are enabled. They can process purchase and technical information required for those functions. The current Our Garage build disables purchases and optional Unity IAP advertising/analytics consent. See Unity's Game Player and App User Privacy Policy (https://unity.com/legal/game-player-and-app-user-privacy-policy) .
- Google AdMob, when rewarded ads are enabled: ad delivery, measurement, diagnostics, consent choices, and fraud prevention. Its SDK can process IP address, approximate location, device or advertising identifiers where available, ad interactions, and diagnostic information. A pseudonymous account binding and reward reference verify the energy reward. Google consent messages appear where required; available privacy choices can be reopened through the privacy controls provided by a game that enables ads. The Our Garage build described below does not include AdMob. See Google advertising information (https://policies.google.com/technologies/ads) .
- Hosting and service infrastructure: our website, database, and supporting delivery services process the information needed to run the member service. These services and the providers above may process information outside your country under their applicable data-protection arrangements.

4. Delete your account and associated data

Use the account deletion entry in your connected game (in Our Garage: Account → Delete account), or visit member.kangkoong.com/delete-account (https://member.kangkoong.com/delete-account?lang=en) . Sign in and complete the ownership verification and confirmation shown there. If you cannot sign in, the public privacy request form (https://member.kangkoong.com/privacy/contact?lang=en)  provides a recovery and deletion assistance route.

This deletes the entire shared Kangkoong account, including its access to connected games. It is not just a sign-out or a reset of one race. Associated account profile, sign-in links, sessions, and active game balances are removed. Your account, unused in-game balances, purchases, and progression cannot be restored through a new registration. Account deletion does not automatically refund purchases; purchase disputes or refund requests follow the relevant store's process.

A website cannot directly erase files on an offline device. After account deletion, clear the game's local data on each device. On Android, open Settings → Apps → [game name] → Storage → Clear storage/data (the wording may vary by device). This also removes other local game profiles on that device. Device or platform backups are controlled separately by their respective providers.

What is removed and what remains

While your account is active, we keep the information needed to provide the account, balances, and connected services. When deletion completes, we erase the member profile, email and password credentials, provider identity links, game memberships, active wallets, associated privacy-request messages, and website/game sessions. Pending ad challenges and delivery grants are removed.

If a linked authentication provider cannot complete erasure immediately, access is revoked and the deletion remains pending for retry. We show a pending result instead of claiming the account is fully erased.

- Purchase and refund evidence: transaction records are detached from the member account. For up to 30 days after deletion, limited purchase tokens, order/product identifiers, and transaction amounts may remain for purchase reconciliation, refunds, and fraud prevention. Scheduled cleanup then removes those details.
- Minimum replay-prevention records: a one-way purchase/reference hash and limited transaction facts remain without a member profile or sign-in link to prevent the same purchase being credited again. These records are pseudonymous, not guaranteed anonymous, and have no automatic expiry.
- Shared KANG transfer history: the deleted party's account reference and transfer note are removed. Amounts, dates, and references needed for the other party's transaction history remain; they do not restore the deleted account.
- Deletion confirmation: a hashed, expiring session reference can remain for 30 days so an already signed-in game can confirm that deletion completed and clear its local account save. It contains no name, email, or member profile and cannot sign in.
- Interrupted sign-in protection: a hash of a deleted Firebase identity can remain for 30 days, and a hash of a deleted Google identity for 10 minutes, to prevent sign-in requests already in progress from recreating the erased account. These records contain no email or profile and are removed after their expiry.
- Privacy requests: request messages and contact details are kept while the request is being handled, then deleted 30 days after the request is closed. Requests associated with the deleted account email are erased when account deletion completes.

Restricted security logs and infrastructure backups may be managed separately from the live account database. For a request concerning those records, use the privacy request form; we will explain the applicable handling rather than promise that deleting the live account erases every provider's copy immediately.

Deleting Kangkoong does not delete your personal Google account or Google's own purchase history. We remove the sign-in connection and request deletion of authentication records created for our service where applicable. Providers may retain records they control under their own policies.

5. Your choices and requests

You can review your profile in Member Area and correct editable information there. For access, correction, deletion assistance, or other rights that apply where you live, use our privacy request form (https://member.kangkoong.com/privacy/contact?lang=en) . We may ask you to verify account ownership before disclosing or changing account data. Submitting a contact message alone does not authorize us to delete another person's account.

You can manage Google account connections and device advertising settings through Google or your device. Removing a sign-in permission or uninstalling the game does not by itself submit a Kangkoong account deletion request.

6. Security, children, and policy updates

We use access controls, hashed passwords, HTTPS for the game account connection, and token verification to protect information. No method of storage or transmission is completely secure.

If you are a parent or guardian and believe a child has provided information that should be removed, contact us through the privacy request form so we can verify and address the request.

We update this page when our data practices change. The date above identifies this version. New uses that require a separate notice or consent will be presented through the relevant service.