Hams Global Privacy Policy

1. Scope, Platforms, Languages, and Service Availability

1.1 Services Covered

Hams is a general-purpose in-App browser and local media-management application. Depending on the version and feature available to you, Hams may provide:

• web browsing;
• media detection and recognition;
• media previews;
• download-task management;
• local file and media management;
• bookmarks and home-screen shortcuts;
• Private Vault and Secure Vault features;
• anonymous installation identifiers;
• memberships and subscriptions;
• advertising and rewarded-ad features;
• consent and privacy-choice management;
• product analytics and crash diagnostics;
• App-integrity and abuse-prevention services; and
• server-assisted access-control or recovery features for certain protected functions.

Most browsing, downloading, file-management, and Vault-content processing takes place locally on your device. Hams-controlled backend systems and third-party service providers process limited information where reasonably necessary to provide subscriptions, advertising, consent management, analytics, diagnostics, security, integrity verification, reward validation, and certain server-assisted recovery functions.

1.2 Current Platform Scope

As of the Last Updated date, this Privacy Policy applies to the released Android version of Hams, including:

• the Hams Android App and its in-App browser;
• media-detection, preview, download, and local file-management features;
• anonymous identifiers, memberships, subscriptions, advertising, and rewarded-ad features;
• consent-management, diagnostic, integrity-verification, security, and abuse-prevention services; and
• support, privacy, deletion, complaint, appeal, or other requests submitted through an official Hams website or email address.

Before releasing Hams on iOS or another platform, we may update this Privacy Policy to reflect the relevant features, permissions, service providers, and information practices.

1.3 Language Versions

This Privacy Policy may be published in English, Traditional Chinese, and Simplified Chinese. Each language version is intended to have the same substantive meaning.

To the extent permitted by applicable law, the English version controls if there is an inconsistency among language versions. A translation is provided for convenience and does not independently expand the Services, create additional representations, or make Hams available in a jurisdiction where it is not otherwise offered.

1.4 Mainland China

Hams is not intended, authorized, marketed, distributed, or supported for operation in mainland China. A Simplified Chinese translation may be provided solely for language accessibility and does not mean that Hams is offered or operated in mainland China.

Access through an unofficial distribution channel or unauthorized third-party redistribution does not constitute an authorized offering of Hams in mainland China. We may restrict, suspend, or discontinue access or functionality in any jurisdiction based on applicable law, platform requirements, security considerations, technical limitations, or business decisions.

If Hams is formally launched in mainland China in the future, we will assess applicable requirements and update relevant disclosures before that launch.

1.5 Third-Party Websites and Content

This Privacy Policy does not govern third-party websites, services, advertisements, content providers, or other third parties that you access through Hams.

When you visit a third-party website, that third party may independently collect or receive information, including your IP address, User-Agent, device-request information, cookies, login or account status, web requests, information entered into web forms, and interactions with the website or its content. Third-party websites may set or read cookies, web local storage, session storage, caches, scripts, pixels, and similar technologies under their own terms and privacy policies.

Hams does not control, endorse, or assume responsibility for a third party’s content, privacy practices, security measures, data processing, legal compliance, or service availability. You should review the applicable third-party terms and privacy notices before providing information to a third party.

2. Operator and Privacy Contact

For processing reasonably within Hams’s control, the operator and responsible entity is:

• Product: Hams
• Public Developer Name: Neon Owl
• Operator, Data Controller, and “Business” where applicable: KUN QIAN
• Principal Contact Address: 10 Bayfront Avenue, Singapore 018956
• Privacy Contact and Data Protection Officer: KUN QIAN
• Email: hamsbrowser@gmail.com

The legal role of a third-party provider may vary according to the service, contractual arrangement, and applicable law. A provider may act as a processor or service provider for Hams for some processing and as an independent controller or business for other processing.

3. General Privacy Practices

For information processing reasonably within our control, we seek to apply the following practices:

1. We limit processing to information reasonably necessary for specified and legitimate purposes.

1. We keep browsing, download, file-management, and Vault-content data on your device whenever reasonably practicable.

1. Except when you voluntarily submit an attachment through an official support, complaint, appeal, or feedback channel, Hams does not upload downloaded videos, downloaded images, thumbnails, plaintext Private Vault file contents, or plaintext Secure Vault file contents to Hams-controlled backend systems.

1. Where a Vault feature requires server-assisted access control or recovery, Hams processes only the encrypted recovery material and non-content security metadata reasonably necessary for that function, as described in this Privacy Policy.

1. We do not directly receive your complete payment-card number, payment password, or complete payment credentials from Google Play.

1. We are not in the business of selling personal information, and we do not sell personal information for monetary payment. Certain advertising-related disclosures may nevertheless be defined as a “sale,” “sharing,” cross-context behavioral advertising, or processing for targeted advertising under some laws, even where no money is exchanged.

1. To the extent reasonably within our control, we use contractual arrangements, product settings, access controls, security measures, and service-provider review to manage processing performed on our behalf.

1. When information is no longer reasonably necessary for an applicable purpose, we delete, deidentify, aggregate, restrict, or stop processing it, subject to legal, security, fraud-prevention, dispute-resolution, backup, and technical exceptions.

If you decline information processing that is necessary for a feature, we may be unable to provide that feature. Declining non-essential processing will not, by itself, prevent access to unrelated core functions that do not depend on that processing, except as otherwise permitted by applicable law.

4. Information We Process

The information processed depends on the Hams version, features you use, device and operating-system configuration, membership status, geographic location, consent choices, and third-party service configuration.

4.1 Information You Voluntarily Provide

Hams does not currently provide user-facing registration or sign-in through an email address, phone number, Google Account, or Apple Account. Hams does not require you to create a Hams password.

If you contact us or submit a support, privacy, deletion, complaint, appeal, legal, or feedback request, we may process:

• your email address;
• your name or other contact information, if you choose to provide it;
• the description of your issue or request;
• troubleshooting steps and information about the relevant page or feature;
• screenshots, screen recordings, logs, or other attachments you submit;
• subscription, purchase, or transaction-reference information you provide;
• an anonymous identifier or other technical identifier you provide to help locate relevant records; and
• information reasonably necessary to verify the request, prevent fraud, investigate a complaint, address a subscription issue, or resolve a dispute.

Please do not send passwords, complete payment-card numbers, payment credentials, complete government-issued identification documents, private media files, authentication tokens, recovery keys, or other sensitive information unless it is specifically requested and reasonably necessary to process your request.

We may delete or decline to process unsolicited information that is irrelevant, excessive, unlawful, or creates an unreasonable security risk.

4.2 Anonymous Installation Identifiers

Hams uses Firebase Anonymous Authentication to generate an anonymous identifier associated with the current App installation.

The identifier may be used to:

• distinguish the current installation;
• associate membership entitlements;
• verify access to protected features;
• synchronize subscription status;
• validate rewarded-ad benefits;
• apply rate limits;
• prevent duplicate redemption or abuse; and
• associate limited security, diagnostic, or recovery records.

Hams does not currently provide a user-facing registered Hams account. The Firebase anonymous identifier is not anonymous in the absolute sense because it may distinguish an installation and may be associated with related service records for a period of time.

The identifier is not intended to directly identify you by name. It may nevertheless constitute personal information under laws that treat persistent device, installation, or online identifiers as personal information.

4.3 Membership and Subscription Information

When you purchase, restore, or use a membership or subscription, Hams, Google Play, RevenueCat, and related systems may process:

• an anonymous identifier;
• a RevenueCat or other subscription-user identifier;
• VIP, SVIP, or another membership tier;
• entitlement status;
• product identifiers;
• subscription status;
• purchase, renewal, expiration, cancellation, refund, or restoration status;
• transaction or order-status information;
• subscription-event identifiers;
• entitlement-synchronization records;
• entitlement-issuance records;
• rate-limit or abuse-prevention records;
• processing timestamps;
• error categories; and
• information reasonably necessary for subscription reconciliation, fraud prevention, customer support, or dispute handling.

Purchases and subscription billing are processed by Google Play and applicable subscription-service providers. Hams does not directly receive your complete payment-card number, payment password, or complete payment credentials.

Hams-controlled backend systems may store limited subscription snapshots and synchronization records to validate entitlements, reduce service disruption, prevent abuse, and address inconsistencies among Hams, Google Play, and RevenueCat.

4.4 Product Analytics

Hams may use Firebase Analytics to process limited information about how the App and its features are used, including:

• App-instance identifiers;
• App launches and sessions;
• App version and operating-system information;
• device category or model information;
• language and general configuration information;
• feature-use events;
• feature-availability or compatibility events;
• limited performance-related parameters;
• automatically collected events provided by Firebase Analytics; and
• limited custom events and parameters defined by Hams.

Hams limits the custom analytics events and parameters it defines. We do not intentionally include the following in Hams-defined analytics events or parameters:

• complete URLs;
• webpage paths;
• query strings;
• page titles;
• search terms;
• file names;
• download-source links;
• cookies;
• authentication or authorization tokens;
• complete local file paths;
• webpage body content; or
• information entered into webpage forms.

Certain website-related compatibility events may include a simplified site label, such as a site-brand value after subdomains, paths, and query parameters have been removed. A simplified site label does not include the complete URL, webpage path, query parameters, or webpage body content, but it may indicate the brand of a website visited. We treat this as browsing-related information, restrict its use, and use it only for compatibility, error investigation, and aggregate feature analysis.

Firebase Analytics may automatically process App-instance identifiers, device information, App information, usage events, and related technical information according to its own technical mechanisms, product settings, and terms.

4.5 Crash and Diagnostic Information

Hams may use Firebase Crashlytics and related diagnostic tools to investigate crashes, non-fatal errors, performance issues, and compatibility problems.

Diagnostic information may include:

• crash stacks;
• exception and error messages;
• extracted crash information;
• device model;
• operating-system version;
• Hams version;
• runtime and process status;
• session or installation information;
• warning- or error-level technical logs;
• limited custom diagnostic keys;
• timestamps;
• network or feature state relevant to an error; and
• a hashed or pseudonymous identifier associated with the current anonymous identifier.

The hashed or pseudonymous identifier may be used to determine whether the same installation repeatedly experiences a particular issue. Hashing or pseudonymization reduces direct identifiability but does not necessarily make information legally anonymous.

Hams does not intentionally write webpage body content or webpage form input into diagnostic logs. We seek to mask or reduce common cookies, authorization information, query-parameter values, and token patterns.

Automated filtering cannot guarantee detection of all personal information that may unexpectedly appear in an error message or technical log. If diagnostic information unintentionally contains personal information, we restrict access and process it only as reasonably necessary to investigate and correct the issue, protect the App or its users, address a security incident, resolve a dispute, or comply with applicable law.

4.6 Advertising and Consent-Management Information

Depending on your membership tier, location, consent status, device settings, applicable law, and the feature you use, Hams may display personalized ads, non-personalized ads, limited ads, ads supported only by technical ad-delivery functions, rewarded ads, or other available ad formats through Google AdMob.

Hams may use Google’s User Messaging Platform (“UMP”) or another consent-management interface to present advertising and privacy choices where configured or required.

Advertising and consent-management services may process:

• advertising identifiers;
• IP address;
• device and App information;
• ad-request information;
• approximate location derived from an IP address or similar information;
• consent status and privacy-message status;
• advertising configuration;
• ad impressions;
• ad interactions and clicks;
• ad revenue and measurement information;
• advertising frequency and delivery information;
• rewarded-ad item and quantity;
• ad-unit and ad-network information;
• rewarded-ad transaction identifiers; and
• an anonymous identifier or related verification information used to validate rewards or prevent duplicate redemption.

Hams does not globally force all AdMob requests to be non-personalized. The advertising mode used for a particular request may depend on the user’s location and choices, applicable legal requirements, Google’s ad-serving configuration, device settings, available consent signals, and technical fallback rules.

The availability and content of advertising privacy controls may vary according to jurisdiction, device and operating-system settings, advertising-service configuration, membership tier, consent status, availability of a privacy message, and changes made by the advertising provider.

Membership ad-removal benefits apply only to standard Hams in-App ads expressly covered by the applicable membership plan. They do not remove advertising displayed by third-party websites. Rewarded ads used to preview, trial, or temporarily unlock premium functionality may not be included in a membership’s standard ad-removal benefits. The applicable purchase page or feature screen controls the scope of the membership benefit.

4.7 Rewarded-Ad Validation

To issue rewarded-ad benefits and prevent duplicate redemption or fraud, Hams-controlled backend systems may process and retain:

• reward-redemption sessions;
• server-side verification records;
• reward status;
• ad-unit information;
• ad-network information;
• reward item and amount;
• transaction identifiers;
• anonymous identifiers;
• processing timestamps;
• expiration timestamps;
• retry or error information; and
• records showing whether a reward was issued, rejected, expired, reversed, or previously redeemed.

We may delay, deny, reverse, or investigate a reward where the relevant verification information is missing, invalid, duplicated, expired, inconsistent, or indicates suspected abuse.

4.8 App Integrity, Security, and Abuse Prevention

Hams may use Firebase App Check, Google Play Integrity, Firebase Cloud Functions, Cloud Firestore, and related security systems to verify that requests originate from an official or sufficiently trusted version of Hams and to protect memberships, rewards, Vault features, and other protected operations.

Information processed for these purposes may include:

• App-integrity tokens;
• integrity verdicts and verification results;
• limited App- and device-integrity signals;
• licensing or installation status;
• protected-operation type;
• request status;
• request and response timestamps;
• anonymous or subscription-user identifiers;
• installation or device-attestation identifiers;
• random values or nonces;
• replay-prevention information;
• risk categories;
• expiration times;
• operation-cooldown information;
• rate-limit records; and
• information reasonably necessary to detect tampering, automation, repeated requests, abnormal access, fraud, or circumvention of restrictions.

Hams may locally evaluate indicators of Root access, debugging, tampering, Hook activity, emulation, or other runtime-environment risks. Hams does not use this local evaluation to upload a complete list of installed applications, your personal files, your downloaded media, plaintext Vault contents, or webpage content.

Hams-controlled backend systems receive only the integrity result, security status, risk category, and associated identifiers reasonably necessary for a protected operation.

4.9 Information Stored Locally on Your Device

Most browsing, download, file-management, and Vault-content information is stored locally on your device.

Depending on the features you use, local information may include:

• URL-type browsing history and recently entered addresses;
• bookmarks, home-screen shortcuts, and browser state;
• download jobs, status, source information, file names, and completed-download records;
• downloaded videos, images, and other files;
• thumbnails, cover images, preview resources, and temporary files;
• Hams settings and preferences relating to language, display, download quality, network use, previews, and file management;
• cookies, web cache, session information, and web local storage;
• Private Vault and Secure Vault files;
• local security state;
• membership tickets or local entitlement information;
• local verification records;
• installation identifiers;
• device-key state;
• operation-cooldown state;
• Terms or policy-version confirmation records; and
• recovery prompts or related local recovery information.

Except as otherwise described in this Privacy Policy, local content is not uploaded to Hams-controlled backend systems.

Files saved to a shared device directory or another user-accessible storage location may remain on the device after you uninstall Hams. You are responsible for deleting files stored outside Hams’s private application storage.

Clearing Hams data or uninstalling Hams may make locally encrypted or protected content permanently inaccessible. Hams cannot guarantee that local content, Vault content, encryption keys, or recovery information can be restored after deletion, device loss, system reset, corruption, security-state changes, or failed recovery verification.

4.10 Website Icons

To display website icons for bookmarks or home-screen shortcuts, Hams may send the relevant website hostname to a Google-provided website-icon service.

The request does not need to contain the complete URL, webpage path, or query string. Google may nevertheless receive information normally included in a network request, including an IP address and device-request information. Website icons may be cached locally to reduce repeated requests.

4.11 Private Vault and Secure Vault Server-Assisted Access Control and Recovery

If you enable or use a Private Vault or Secure Vault feature that requires server-assisted access control or recovery verification, Hams does not upload to Hams-controlled backend systems:

• the Vault’s plaintext file contents;
• plaintext Vault thumbnails; or
• a plaintext key that Hams-controlled backend systems could independently use to decrypt the Vault’s file contents.

To validate membership entitlements, device trust, access eligibility, and recovery eligibility, Hams-controlled backend systems may process encrypted recovery material and non-content security metadata, including:

• an anonymous or subscription-user identifier;
• an installation identifier;
• a device-attestation or device-proof identifier;
• a Vault identifier;
• encrypted recovery material;
• a digest or identifier associated with encrypted recovery material;
• recovery-session status;
• processing and delivery status;
• entitlement status;
• operation timestamps;
• validity periods; and
• expiration times.

Encrypted recovery material is provided to an eligible device only after the relevant operation is initiated and the required entitlement and device verification is completed.

Availability of server-assisted access control or recovery may depend on membership status, device-security status, availability of necessary identifiers or keys, network conditions, integrity-verification results, service availability, technical compatibility, compliance with applicable limits, and the absence of suspected fraud or abuse.

Server-assisted recovery is not a guarantee that Vault data can be recovered in every circumstance.

4.12 Clipboard, Android Sharing, and Motion Input

Hams may detect whether the device clipboard contains a link that can be opened and may ask whether you want to open that link in Hams. Unless you choose to open the link or otherwise take the relevant action, Hams does not send the clipboard link to Hams-controlled backend systems.

When you share text or a link with Hams through the Android share sheet, Hams reads and parses the shared content locally to open the link or perform the action you requested. Unless you perform a subsequent action that requires a network connection, or this Privacy Policy states otherwise, the shared content is not sent to Hams-controlled backend systems.

Hams may offer optional motion-input functionality, such as detecting a shake gesture and displaying an action prompt. Motion data used for this functionality is processed locally to recognize the gesture and is not used for advertising profiling or continuous background tracking.

4.13 Device Permissions and System Access

Depending on the Android version and feature you use, Hams may use or request:

• internet access;
• network-state access;
• foreground-service access;
• data-sync foreground-service access;
• notification permission;
• biometric-authentication capability; and
• advertising-identifier permission used by applicable advertising services.

Internet and network-state access are used to open websites, download files, validate memberships, communicate with service providers, and provide connected features. Foreground-service permissions may be used to continue download or data-sync tasks where Android permits. Notification permission may be used to display download progress, completion status, errors, and other task information.

Hams uses the Android biometric-authentication interface only to receive a success, failure, or cancellation result for local security functionality. Hams does not read, retain, or upload your fingerprint template, facial template, or another biometric template.

As of the Last Updated date, the current Android version of Hams does not request:

• precise or approximate device-location permission;
• camera permission;
• microphone permission;
• contacts permission;
• calendar permission;
• general media-library read permission; or
• “manage all files” permission.

If Hams features or permissions materially change, we may update this Privacy Policy and provide any additional in-App disclosure, permission request, or consent choice required by applicable law or platform policy before using the new permission.

4.14 Information Processed by Third-Party Websites

When you open a third-party website through Hams, that website may receive information directly from your device without that information first being received by Hams-controlled backend systems.

This may include IP address, User-Agent, network-request headers, cookies, website login state, webpage requests, information you submit to the website, media or resources requested from the website, and your interactions with the website.

Websites may use cookies, fingerprinting, local storage, pixels, scripts, advertising technologies, analytics tools, and other mechanisms independently of Hams. Hams does not determine or control how a third-party website uses information it receives directly.

5. Sources of Information

Depending on the feature, we may obtain information:

• directly from you;
• automatically from the App or your device;
• from Google Play;
• from RevenueCat;
• from Firebase and Google services;
• from advertising and consent-management providers;
• from security and integrity-verification providers;
• from email or support-service providers;
• from service providers acting for Hams;
• from authorities or parties involved in a legal or security request; and
• from another source where you direct or authorize the disclosure.

Third-party websites you visit through Hams generally receive information directly from your device and are independently responsible for their collection.

6. How and Why We Use Information

We may process information to:

1. provide web browsing, media detection, previews, downloads, and local file-management functions;
2. create and maintain an anonymous identifier for the current installation;
3. validate, restore, synchronize, and provide membership entitlements;
4. process subscription status and assist with subscription-related support;
5. display personalized, non-personalized, limited, technically delivered, contextual, rewarded, or other available advertising;
6. obtain and manage advertising or privacy choices;
7. issue, validate, expire, deny, or reverse rewarded-ad benefits;
8. verify App integrity and device trust;
9. prevent fraud, abuse, duplicate redemption, replay, unauthorized access, and circumvention of technical restrictions;
10. provide Private Vault or Secure Vault server-assisted access control and recovery verification;
11. analyze limited product usage;
12. identify compatibility issues and improve features;
13. investigate crashes, errors, and performance problems;
14. save settings and user preferences;
15. respond to support, privacy, deletion, complaint, appeal, and dispute requests;
16. establish, exercise, or defend legal claims;
17. enforce applicable terms, purchase conditions, membership conditions, and security restrictions;
18. comply with laws, court orders, regulatory requests, tax or accounting requirements, and app-store policies;
19. investigate security incidents or suspected illegal conduct;
20. protect the rights, property, safety, security, and legitimate interests of Hams, users, service providers, and third parties; and
21. perform another purpose disclosed to you or permitted by applicable law.

6.1 Legal Bases Where Required

Where applicable law requires a legal basis, we may rely on one or more of the following:

Performance of a contract or steps taken at your request. We process information where reasonably necessary to provide a feature you request, provide or restore a subscription entitlement, complete a protected operation, or respond to a support request.

Consent. We rely on consent for personalized advertising, access to or storage of information on a device, optional analytics, or other processing where applicable law requires consent. The availability and effect of a consent choice depend on the applicable processing and service configuration.

Legitimate interests, where recognized by applicable law. We may process information where reasonably necessary to secure Hams, prevent fraud and abuse, validate entitlements and rewards, investigate technical problems, improve compatibility and performance, protect Vault features, maintain records reasonably necessary for disputes, or establish, exercise, or defend legal claims. We rely on legitimate interests only where those interests are not overridden by applicable rights and freedoms.

Legal obligations. We may process information to comply with applicable legal, regulatory, tax, accounting, consumer-protection, payment, security, or law-enforcement obligations.

Vital interests. We may process information where reasonably necessary in an emergency to protect a person’s life, physical safety, or other vital interests.

Other lawful bases. In jurisdictions that do not recognize legitimate interests as an independent legal basis, we rely on consent, contract performance, legal obligations, exceptions, deemed-consent rules, or another lawful basis recognized in that jurisdiction.

Not all processing relies on consent. Withdrawing or declining consent does not require Hams to stop processing that is supported by another lawful basis.

7. Advertising, Sale or Sharing, and Privacy Choices

Depending on advertising configuration and applicable law, an advertising provider may use identifiers, device information, network information, approximate location, consent information, or limited App activity for ad delivery, frequency management, fraud detection, measurement, contextual advertising, personalized advertising, cross-context behavioral advertising, or targeted advertising.

We do not sell personal information for monetary payment. Depending on applicable law and advertising configuration, disclosures of advertising identifiers, device or network information, approximate location, consent information, or limited App activity to advertising providers may be considered a “sale,” “sharing,” cross-context behavioral advertising, or processing for targeted advertising.

Where required and supported by the applicable consent-management configuration, Hams may present a Privacy Settings, Privacy Options, Manage Privacy Choices, Do Not Sell or Share My Personal Information, or similarly labeled entry point. An applicable opt-out may cause Google or another provider to apply restricted data processing or otherwise limit advertising personalization for the relevant device, installation, or request.

You may also be able to control advertising through Android or Google advertising settings, device privacy settings, Google Play settings, a consent-management message, or by contacting us.

A privacy choice may apply only to the relevant device, installation, advertising identifier, browser, or service. Clearing App data, resetting an advertising identifier, changing devices, reinstalling Hams, or changing service configuration may require the choice to be made again where permitted by law.

Hams does not independently respond to conventional browser “Do Not Track” headers because no uniform technical standard applies to all such signals. Google or other providers may receive and act on Global Privacy Control or other legally recognized preference signals associated with an advertising request. Where applicable law requires Hams to honor a valid opt-out preference signal that Hams can reasonably recognize and apply to the relevant processing, Hams will do so.

8. Automated Security Decisions

Hams may use automated methods to evaluate App integrity, installation or device trust, membership eligibility, entitlement status, reward eligibility, duplicate redemption, rate-limit status, abnormal-access risk, tampering risk, and Vault access-control or recovery eligibility.

Based on that evaluation, Hams may approve an operation, request additional verification, impose a delay or cooldown period, apply a rate limit, deny an operation, expire or reject a reward, restrict a protected feature, or refer an event for investigation.

These decisions are used to protect Hams, memberships, rewards, Private Vault, Secure Vault, and other protected functionality. They are not used to create advertising profiles.

Hams does not use automated decision-making to make decisions about employment, housing, education, credit, lending, insurance, medical treatment, or another matter that produces a legal or similarly significant effect of that kind.

If you believe an automated security decision is incorrect, you may contact us. We may investigate to the extent we can reasonably verify the relevant installation, transaction, entitlement, or request without undermining security or fraud-prevention measures.

We are not required to disclose confidential security rules, fraud signals, source code, detection thresholds, or information that could enable circumvention of protective measures, except where applicable law expressly requires disclosure.

9. How We Disclose Information

We disclose information only where reasonably necessary for the purposes described in this Privacy Policy, as directed by you, or as otherwise permitted by applicable law.

9.1 Service and Technology Providers

Hams currently may use:

• Firebase Authentication to generate and manage anonymous identifiers;
• Firebase Analytics for limited product analytics;
• Firebase Crashlytics for crash, error, and stability diagnostics;
• Firebase App Check for App and request integrity verification;
• Firebase Cloud Functions and Cloud Firestore for backend processing, security, entitlement synchronization, reward verification, rate limiting, and Vault access-control or recovery records;
• Google Play Integrity for integrity and anti-abuse verification;
• RevenueCat for subscription validation, purchase restoration, subscription status, and entitlement management;
• Google Play for purchases, subscription billing, refunds, and order management;
• Google AdMob for personalized and non-personalized advertising, limited ads, rewarded ads, ad delivery, and measurement;
• Google UMP for applicable consent and privacy-choice management;
• a Google-provided website-icon service to obtain website icons for bookmarks or shortcuts; and
• email and support-service providers to process messages and requests that you submit.

A provider may collect or receive device, App, network, identifier, subscription, advertising, consent, diagnostic, transaction, or security information according to the relevant service, configuration, and provider terms.

Provider services, technical mechanisms, and names may change. We may replace a provider with another provider performing a substantially similar function. We will update this Privacy Policy where a change materially affects the practices described here and applicable law requires notice.

9.2 Legal, Security, and Protection Disclosures

We may disclose information where we reasonably believe disclosure is necessary to:

• comply with applicable law;
• respond to a valid court order, subpoena, warrant, regulatory request, or legal process;
• investigate fraud, abuse, security incidents, or illegal conduct;
• respond to an infringement or rights complaint;
• protect the life, physical safety, security, property, or legal rights of a person;
• enforce applicable terms or purchase conditions;
• establish, exercise, or defend a legal claim; or
• protect Hams, users, service providers, or third parties.

Where legally permitted and reasonably practicable, we may evaluate a request for legal validity and scope before disclosure. We may object to, limit, or challenge a request, but we are not obligated to do so.

9.3 Business Transactions

We may disclose or transfer information in connection with an actual or proposed merger, acquisition, financing, sale of assets, reorganization, insolvency, business succession, service transfer, or change in control.

A recipient may continue processing the information subject to this Privacy Policy, a replacement privacy notice, and applicable law.

9.4 With Your Direction or Authorization

We may disclose information when you direct us to do so, request a feature that requires disclosure, or provide legally valid authorization.

10. Aggregated and Deidentified Information

We may create aggregated, statistical, or deidentified information from information processed through the Services.

Where information is legally considered deidentified, we will not attempt to reidentify it except to test whether deidentification measures remain effective, protect security, prevent fraud, comply with law, or as otherwise permitted by applicable law.

We may use and disclose aggregated or deidentified information for lawful purposes, including analytics, compatibility analysis, security, product improvement, research, and business planning.

11. Data Retention

We determine retention periods based on the purpose for which information was processed, the nature and sensitivity of the information, whether it is stored locally or by a provider, relevant system configuration and expiration rules, security and fraud-prevention requirements, subscription and dispute-resolution needs, anticipated legal claims, legal or regulatory obligations, backup cycles, and technical limitations.

We do not undertake to retain information for any minimum period unless required by law or reasonably necessary to provide a feature.

11.1 Information Stored on Your Device

Browsing history, bookmarks, download records, downloaded files, cache, cookies, settings, Terms-confirmation records, Private Vault content, and Secure Vault content generally remain on your device until:

• you delete or clear them in Hams;
• Hams deletes, expires, or reduces them under current product rules;
• you clear Hams App data through Android;
• you uninstall Hams;
• the operating system removes the relevant information; or
• for files stored in a shared directory, you delete them yourself.

Uninstalling Hams may not delete files stored in shared storage or another location outside Hams’s private application storage.

11.2 Anonymous Identifiers

A Firebase anonymous identifier is generally associated with the current App installation.

If you clear Hams App data or uninstall Hams, the device will ordinarily lose access to the prior identifier. This does not necessarily mean that corresponding Firebase, security, subscription, diagnostic, or Hams backend records are immediately deleted.

If you use a “Delete Anonymous Identifier” or similarly labeled feature, Hams will initiate a request to delete the current Firebase anonymous identity. Related records may remain until the applicable deletion process and backup cycle are completed, the relevant retention period expires, the record is deidentified, the record is no longer reasonably necessary, or a legal, security, fraud-prevention, transaction, dispute, or technical exception no longer applies.

If Hams later requires an anonymous identifier, the App may generate a new identifier.

11.3 Subscription and Transaction Information

Google Play, RevenueCat, and related providers may retain purchase, subscription, restoration, cancellation, refund, fraud-prevention, and entitlement information for the period reasonably necessary to administer subscriptions, reconcile transactions, process refunds, maintain purchase records, prevent fraud, address chargebacks or disputes, and comply with tax, accounting, consumer-protection, or other legal obligations.

Their retention periods are also governed by their own policies, contracts, and system settings.

11.4 Analytics and Diagnostic Information

Analytics and diagnostic information is retained according to the relevant product configuration, provider retention settings, the time reasonably necessary to analyze a problem, security and fraud-prevention needs, the need to measure App compatibility or stability, and applicable law.

Hams may change analytics or diagnostic retention settings where reasonably appropriate.

11.5 Security, Reward, and Recovery Information

Integrity-verification records, rate-limit records, random values, reward-redemption sessions, and recovery sessions may automatically expire when their configured validity period ends.

Other security, reward, entitlement, and recovery records may be retained until they are no longer reasonably necessary for verification, replay prevention, duplicate-redemption prevention, access control, security investigation, fraud prevention, membership reconciliation, dispute resolution, or legal compliance.

11.6 Support and Privacy Requests

Support messages, privacy requests, complaints, appeals, attachments, and related handling records may be retained until the request is resolved and for an additional period reasonably necessary for follow-up communication, quality assurance, fraud prevention, security, dispute resolution, legal claims, and compliance documentation.

After that period, we may delete, deidentify, or restrict the information unless continued retention is permitted or required.

11.7 Backups

Information scheduled for deletion may remain in encrypted or restricted backup systems until overwritten or removed through the applicable backup cycle.

We may retain backup information for disaster recovery, security, legal compliance, or system-integrity purposes. Backup information is not restored to active systems except where reasonably necessary for those purposes.

12. Your Controls and Deletion Options

Depending on available Hams features, you may be able to:

• clear all or part of your browsing history;
• clear cookies, web cache, session data, and web local storage;
• delete download jobs and download history;
• delete local downloaded files;
• delete thumbnails and preview cache;
• delete Private Vault and Secure Vault content;
• change available advertising choices;
• reopen an available consent or privacy-options interface;
• manage or cancel a subscription through Google Play;
• initiate deletion of the current anonymous identifier;
• clear Hams App data through Android;
• uninstall Hams; and
• submit a privacy or deletion request concerning information reasonably within our control.

12.1 Effect of Deleting an Anonymous Identifier

The “Delete Anonymous Identifier” feature, or a similarly labeled feature:

• initiates deletion of the current Firebase anonymous identity;
• does not automatically delete files, browsing history, cookies, cache, Private Vault content, or Secure Vault content stored locally on your device;
• does not cancel a Google Play subscription;
• does not issue a refund;
• does not automatically delete records independently retained by Google Play, RevenueCat, Firebase Analytics, Firebase Crashlytics, Google AdMob, Google Play Integrity, or another provider;
• does not necessarily immediately delete Hams backend records used for Vault access control, recovery, reward validation, subscription reconciliation, security, or abuse prevention;
• does not override information that must or may be retained for legal, payment, fraud-prevention, security, dispute, backup, or technical reasons; and
• does not prevent Hams from generating a new anonymous identifier if an identifier is later required.

Deletion may be irreversible. Deleting an identifier or clearing App data may prevent Hams from locating prior entitlements, restoring protected operations, or associating the device with prior security or recovery records, except where purchase restoration or another recovery method remains available.

12.2 Server-Side Deletion Requests

To request deletion of server-side information associated with an anonymous identifier, support email, or another record reasonably within our control, contact us using Section 19.

We may request information reasonably necessary to verify that the request relates to you or your installation, identify the relevant record, verify authority, prevent fraudulent deletion, protect another person’s information, and preserve the security of the Services.

We may be unable to locate information using your name or email address if the relevant records are associated only with an anonymous identifier.

13. Privacy Rights

Depending on where you live and applicable law, you may have rights to:

• confirm whether we process your personal information;
• obtain information about the processing;
• access personal information we maintain about you;
• obtain a copy of certain personal information;
• correct inaccurate or incomplete information;
• delete certain personal information;
• restrict certain processing;
• object to certain processing;
• withdraw consent;
• obtain certain information in a portable format;
• opt out of a sale, sharing, cross-context behavioral advertising, or targeted advertising;
• receive information about certain automated processing;
• appeal a denial of a privacy-rights request;
• use an authorized agent; and
• complain to a competent privacy or data-protection authority.

These rights are not absolute. Exceptions may apply where processing is reasonably necessary to provide a requested service, complete a transaction, maintain security or integrity, prevent fraud or abuse, protect another person’s rights, comply with law, preserve evidence, exercise legal rights, resolve disputes, or perform another purpose permitted by applicable law.

13.1 Verification

We may verify your request by asking for information reasonably related to your anonymous identifier, the relevant installation, a subscription or transaction reference, prior correspondence, your email address, possession of the relevant device, or another fact reasonably necessary to verify the request.

We will not request more verification information than reasonably necessary. Where we cannot reasonably verify a request, we may deny or limit it. The absence of a registered Hams account may limit our ability to verify that information associated with an anonymous identifier relates to a particular person.

13.2 Excessive, Abusive, or Unsafe Requests

To the extent permitted by applicable law, we may deny, limit, charge a reasonable fee for, or delay a request that is manifestly unfounded, excessive, repetitive, fraudulent, unrelated to the requester, likely to adversely affect another person’s rights, likely to compromise security or fraud-prevention systems, or subject to a legal exception.

Where required, we will explain the basis for a denial and provide applicable appeal information.

13.3 Withdrawal of Consent

Where processing is based on consent, you may withdraw that consent through an available in-App control or by contacting us.

Withdrawal does not affect the lawfulness of processing completed before withdrawal. It also does not require us to stop processing supported by another lawful basis.

If processing is necessary for a particular feature, withdrawing consent or authorization may make that feature unavailable.

14. Regional Supplements

The following provisions apply only to the extent the relevant law applies to Hams or the processing in question. If a regional provision conflicts with another part of this Privacy Policy, the regional provision controls only for the affected person and processing, and only to the extent required by applicable law.

14.1 European Economic Area, United Kingdom, and Switzerland

This subsection applies only where the European Union General Data Protection Regulation, United Kingdom data-protection law, Swiss data-protection law, or a substantially similar law applies.

Controller. The controller is the operator identified in Section 2, except where a third-party provider acts as an independent controller for its own processing.

Legal bases. The legal bases on which we may rely are described in Section 6.1 and may include contract performance or steps taken at your request, consent, legitimate interests, compliance with legal obligations, protection of vital interests, and another lawful basis recognized by applicable law.

Our legitimate interests may include providing and securing Hams, maintaining service reliability, preventing fraud and abuse, validating subscriptions and rewards, investigating crashes and errors, protecting Vault functions, responding to disputes, and establishing, exercising, or defending legal claims.

Required information. Where personal data is necessary to provide a requested feature, complete a subscription-related operation, validate a reward, protect a Vault, or respond to a request, failure to provide the necessary information may prevent us from providing the relevant function. Information requested for optional processing is voluntary unless otherwise stated.

Rights. Subject to applicable conditions and exceptions, you may have rights of access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, objection to direct marketing, withdrawal of consent, and complaint to a competent supervisory authority.

You may lodge a complaint with the data-protection authority in the country where you live, work, or believe an infringement occurred. We encourage you to contact us first so that we have an opportunity to address the issue.

Automated processing. Hams uses automated security and integrity decisions as described in Section 8. Hams does not use solely automated processing to make decisions producing legal or similarly significant effects about employment, credit, housing, education, insurance, medical treatment, or access to an essential service.

International transfers. Where required, international transfers may rely on an adequacy decision, standard contractual clauses, a United Kingdom international data-transfer agreement or addendum, contractual and technical safeguards, an applicable derogation, valid consent, or another lawful transfer mechanism. The availability of a particular safeguard depends on the relevant provider, location, and transfer.

14.2 United States State Privacy Rights

This subsection applies only to the extent a U.S. state comprehensive privacy law applies to Hams and the relevant processing.

Depending on your state and subject to applicable exceptions, you may have rights to:

• confirm processing;
• access personal information;
• correct inaccuracies;
• request deletion;
• obtain certain information in a portable format;
• opt out of the sale of personal information;
• opt out of sharing for cross-context behavioral advertising;
• opt out of targeted advertising;
• opt out of certain profiling;
• obtain a list or description of third-party recipients where required;
• use an authorized agent; and
• appeal a denied request.

You may exercise an available advertising opt-out through a privacy control presented in Hams or by contacting us.

To appeal a denied request, reply to our response or send an email with “Privacy Appeal” in the subject line. We may request information reasonably necessary to associate the appeal with the original request.

We will not unlawfully discriminate against you for exercising an applicable privacy right. Subject to lawful exceptions, this means we will not deny a service, charge a different price, or provide a materially different level of service solely because you exercised a privacy right.

A difference related to a membership, reward, subscription, fraud risk, or feature that reasonably depends on the relevant processing is not discrimination where permitted by law.

14.3 California Notice at Collection and CCPA Disclosures

This subsection applies only to the extent the California Consumer Privacy Act, as amended (“CCPA”), applies to Hams and the relevant processing.

Categories Collected

During the 12 months preceding the Last Updated date, depending on the features used, Hams may have collected the following categories of personal information:

Identifiers. Examples include Firebase anonymous identifiers, subscription-user identifiers, App-instance identifiers, advertising identifiers, IP addresses, installation or device-attestation identifiers, transaction identifiers, and an email address submitted to support.

Commercial information. Examples include membership tier, subscription product, purchase status, transaction status, restoration status, refund status, and entitlement information.

Internet or other electronic network activity. Examples include limited App interactions, feature-use events, simplified site-brand information, advertising interactions, network requests, crash events, and diagnostic information.

Approximate geolocation. Advertising or consent-management services may infer a general location from an IP address or similar network information. Hams does not request Android device-location permission in the current version described by this Privacy Policy.

Device and technical information. Examples include device model, operating-system version, Hams version, language, runtime state, integrity results, device-trust information, and technical logs.

User-submitted content. Examples include support messages, screenshots, screen recordings, logs, and attachments that you voluntarily submit.

Security and fraud-prevention information. Examples include integrity signals, risk categories, rate-limit records, protected-operation status, replay-prevention information, reward-validation information, and recovery-session information.

Inferences. Hams may derive limited security, fraud, compatibility, or device-trust classifications from the information described above. These classifications are used for security and service protection, not to infer personal characteristics for advertising.

Sources, Purposes, Retention, and Recipients

We may obtain these categories directly from you, automatically from the App or device, from Google Play, RevenueCat, Firebase or Google services, advertising or consent providers, and security or integrity providers.

We collect, use, and disclose these categories for the business and commercial purposes described in Sections 6 and 9, including providing features, processing subscriptions, advertising, analytics, debugging, security, fraud prevention, reward validation, Vault access control or recovery, customer support, legal compliance, and business transactions.

We retain each category according to the criteria in Section 11. We do not retain a category longer than reasonably necessary for its disclosed purpose, subject to legal, security, fraud-prevention, dispute, backup, and technical exceptions.

We may disclose relevant categories to cloud and backend providers, analytics and diagnostic providers, subscription and payment providers, advertising and consent providers, integrity and security providers, support providers, professional advisers, authorities, legal-process recipients, and recipients involved in a business transaction.

Sale and Sharing

We do not sell personal information for monetary payment.

Depending on applicable law and advertising configuration, during the preceding 12 months Hams may have “shared” advertising identifiers, device or network information, approximate location, consent information, and limited App activity with advertising providers for cross-context behavioral advertising or targeted advertising.

Where the CCPA requires an opt-out, you may use an available Hams privacy-choice control or contact us.

Sensitive Personal Information

Hams does not intentionally use sensitive personal information to infer characteristics about you. Hams does not collect or store biometric templates through Android biometric authentication; it receives only an authentication result.

If information that may be considered sensitive is voluntarily submitted through support, we use it only as reasonably necessary to process the request, protect security, resolve a dispute, or comply with law.

Minors

We do not have actual knowledge that Hams sells or shares the personal information of consumers under 16 in a manner requiring affirmative authorization under the CCPA.

California Rights

Subject to statutory conditions and exceptions, California residents may have rights to know or access, correct, delete, obtain information about categories and recipients, opt out of sale or sharing, limit certain uses of sensitive personal information, use an authorized agent, and receive equal service and pricing when exercising CCPA rights.

An authorized agent may submit a request where permitted. We may require proof of authorization and may separately verify the consumer.

14.4 Taiwan

This subsection applies only to the extent Taiwan’s Personal Data Protection Act applies to Hams or the relevant processing.

For purposes of the required collection notice:

Collecting entity. The collecting entity is the operator identified in Section 2.

Purposes. The purposes are described in Section 6 and include service delivery, subscriptions, advertising, consent management, analytics, diagnostics, security, fraud prevention, reward validation, Vault access control or recovery, customer support, disputes, and legal compliance.

Categories of personal data. The categories are described in Section 4 and may include identifiers, contact information voluntarily submitted to support, subscription and transaction status, device and technical information, limited App-use and browsing-related information, advertising and consent information, diagnostic information, security and fraud-prevention information, and attachments voluntarily submitted to support.

Period, region, recipients, and methods of use. Personal data may be used for the periods determined under Section 11; in Singapore and other countries or regions where Hams, its infrastructure, or its service providers operate; by Hams and the recipients described in Section 9; and through automated systems, local device processing, network communications, backend processing, manual support review, and other methods reasonably necessary for the disclosed purposes.

Your rights. Subject to applicable conditions and exceptions, you may request to inquire about or review your personal data, obtain a copy, supplement or correct the data, stop collection, processing, or use, and delete the data. Where permitted by applicable law, we may charge a necessary and reasonable cost-based fee for providing a copy or responding to a review request.

Effect of not providing information. Where information is necessary for a requested function, subscription, reward, protected operation, security verification, recovery, or support request, failure to provide it may prevent us from providing or completing that function. Failure to provide information for optional processing may affect only the optional processing or feature, subject to applicable law.

14.5 Singapore

This subsection applies only to the extent Singapore’s Personal Data Protection Act applies to Hams or the relevant processing.

The Privacy Contact and Data Protection Officer is identified in Section 2.

Subject to applicable law, you may request access to personal data under our possession or control, information about how that personal data has been used or disclosed, correction of an error or omission, and withdrawal of consent for processing based on consent.

A withdrawal request does not affect processing already lawfully completed and does not require us to stop processing that is permitted without consent. Before consent is withdrawn, we may explain the likely consequences, including loss of a feature that reasonably depends on the relevant processing.

We retain personal data only while it remains reasonably necessary for a legal or business purpose and take reasonable steps concerning protection and overseas transfers as required by applicable law.

15. Children’s and Teens’ Privacy

Hams is a general-audience browser and media-management tool. It is not directed to children under 13.

We do not knowingly collect personal information online from a child under 13 in a manner subject to the United States Children’s Online Privacy Protection Act without required parental authorization.

Hams does not routinely ask users to provide their age or date of birth. A general-audience service may therefore be unable to determine a user’s age unless the user, a parent or guardian, a platform, or another reliable source provides information establishing the user’s age.

If we obtain actual knowledge that we processed personal information from a child under 13 without required parental authorization, we will take measures reasonably required by applicable law, which may include deleting the information, restricting processing, disabling related advertising, obtaining verifiable parental consent, or terminating access to a feature.

Where local law establishes a higher age for consent to particular processing, the user should use Hams only with the involvement or authorization of a parent or legal guardian where required.

Parents and guardians should supervise minors’ use of Hams, including third-party websites visited through Hams, content downloaded or stored, advertising and rewarded-ad interactions, purchases and subscriptions, use of Private Vault or Secure Vault, and disclosure of information to third-party websites.

If you are a parent or guardian and believe Hams has processed a child’s personal information without required authorization, contact us. We may request information reasonably necessary to verify the request and the parental or guardian relationship.

Third-party websites may apply their own age restrictions, content classifications, parental-consent requirements, and children’s privacy practices. Hams does not control those requirements.

16. Security

We use technical and organizational safeguards reasonably appropriate to the nature and risk of information within our control.

Depending on the relevant system, safeguards may include:

• keeping browsing, download, and file-management information on the device;
• using operating-system-protected storage;
• access controls;
• authentication and authorization controls;
• encryption in transit;
• encryption or protected storage at rest where appropriate;
• hashing or pseudonymizing certain identifiers;
• limiting custom analytics parameters;
• masking common cookies, tokens, authorization information, and query values in logs;
• App-integrity verification;
• device-trust verification;
• rate limiting;
• replay prevention;
• abuse-prevention controls;
• limiting access to personnel and providers with a reasonable need;
• security monitoring;
• backup and recovery controls; and
• investigation and response procedures.

No network transmission, application, device, encryption method, recovery system, or storage system can be guaranteed to be completely secure or error-free.

We do not warrant that unauthorized access will never occur, all vulnerabilities will be detected, a device will remain secure, all local files can be recovered, a Vault cannot be compromised through a compromised device, automated filtering will remove all personal information from logs, or every security or recovery request will succeed.

You are responsible for maintaining reasonable control over your device, device credentials, biometric access, operating-system security, backups, downloaded files, and any recovery information made available to you.

If you become aware of a security issue that may affect Hams or information within our control, contact us promptly. Please do not publicly disclose technical details in a manner that creates additional risk before we have had a reasonable opportunity to investigate.

17. International Data Transfers

Hams is offered in multiple countries and regions other than excluded service areas.

Information may be processed in Singapore, the United States, or another country where Hams, Firebase, Google, RevenueCat, email providers, cloud providers, contractors, or other service providers operate.

The data-protection laws of those locations may differ from the laws where you live.

Where applicable law requires a transfer mechanism or safeguard, we may rely on an adequacy determination, contractual clauses, service-provider contractual commitments, technical and organizational safeguards, consent, a legally recognized exception, or another lawful mechanism.

We cannot control transfers independently made by a third-party website you choose to access. Those transfers are governed by the website’s own practices.

You may contact us for additional information about transfers reasonably within Hams’s control. We may withhold confidential commercial terms, security information, or information that we are not legally required or permitted to disclose.

18. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in Hams features, platforms, permissions, service providers, information practices, security practices, advertising configuration, applicable law, app-store requirements, or business operations.

When we update this Privacy Policy, we will revise the Last Updated date and, where appropriate, the Effective Date.

Where required by applicable law, we may provide additional notice through an in-App message, the Hams website, a consent-management interface, a platform notice, email if we have an appropriate email address, or another reasonable method.

Where applicable law requires new consent, we will request that consent before conducting the processing for which new consent is required. Continued use of Hams after an update does not constitute consent where applicable law requires an affirmative consent mechanism.

Historical versions may be made available according to our publication and archival practices. We are not required to maintain public access to every prior version unless applicable law requires it.

19. Contact Us

To ask a question or submit an access, correction, deletion, consent-withdrawal, advertising opt-out, anonymous-identifier deletion, complaint, appeal, or other privacy request, contact:

• Product: Hams
• Public Developer Name: Neon Owl
• Operator, Data Controller, and “Business” where applicable: KUN QIAN
• Privacy Contact and Data Protection Officer: KUN QIAN
• Principal Contact Address: 10 Bayfront Avenue, Singapore 018956
• Email: hamsbrowser@gmail.com

Please include enough information for us to understand and reasonably locate the relevant request, but do not include unnecessary passwords, complete payment information, private media, recovery keys, or sensitive identification documents.

We will verify and respond to requests within the period required by applicable law. Where no statutory response period applies, we will respond within a commercially reasonable period based on the request’s complexity, verification requirements, security considerations, and available information.