Legal
Privacy Policy
This policy explains what personal data Pandaren handles, why, and what you can ask us to do about it. It applies to this website and to every application and game we publish, unless a specific product publishes its own supplementary notice on its App Store listing.
1. Who we are
The data controller responsible for the processing described here is:
| Controller | PANDAREN TRADING LIMITED |
|---|---|
| Registered office | Rm 22B, 22/F, Kiu Yin Commercial Building, 361–363 Lockhart Road, Wan Chai, Hong Kong |
| Privacy contact | dev@pandarentrading.com |
In this policy, “we”, “us” and “our” mean PANDAREN TRADING LIMITED, the company trading as “Pandaren”; “you” means the user of our website, applications or games.
2. Summary
The short version.
- We do not sell, rent or trade personal data. Ever.
- We do not track you across other companies' apps or websites, and we do not use third-party advertising networks.
- Most of our apps work without an account and keep your content on your own device.
- Payments are handled by Apple; we never receive your card details.
- You can ask us to delete anything we hold about you.
3. What we do not do
Unless a specific product's App Store listing states otherwise, we do not:
- embed third-party advertising or ad-attribution SDKs;
- build advertising profiles or track you across apps and websites owned by other companies (as defined by Apple's App Tracking Transparency framework);
- sell or “share” personal information within the meaning of the California Consumer Privacy Act;
- collect precise location, contacts, photos, microphone or camera data unless a feature you actively use requires it — and then only with the system permission prompt and only for that feature;
- require you to create an account to use core functionality, unless the product is fundamentally account-based and says so before purchase.
4. Data we process
4.1 Content you create in our apps
Notes, items, catalogues, save files, settings and similar content are stored locally on your device. Where an app offers synchronisation, it uses Apple's iCloud under your own Apple Account: the data travels to your private iCloud container, which we cannot read. We do not maintain a copy on our own servers.
4.2 Optional accounts
If a product offers an account, we process the identifier you provide (typically an email address, or the private relay address supplied by Sign in with Apple), an authentication token, and the data you choose to store in that account. Account deletion is available in-app and on request.
4.3 Support correspondence
When you email us, we process your address, the content of your message and any attachments or diagnostic details you send, in order to answer you and to keep a record of the issue.
4.4 Purchases
Purchases and subscriptions are transacted by Apple. We receive from Apple aggregated sales and financial reports, and — for validation of in-app purchases — a receipt that identifies the transaction, not you. We do not receive your name, address or payment card details.
4.5 Diagnostics and crash reports
Where Apple's device setting Share with App Developers is enabled by you, Apple may pass us crash logs and performance metrics. Apple aggregates and, where applicable, de-identifies this data before we see it. You control this in Settings → Privacy & Security → Analytics & Improvements.
4.6 Website logs
This website is served by Cloudflare. Cloudflare processes technical request data — including IP address, user-agent string, requested URL and timestamp — for the purposes of delivering the site securely and mitigating attacks. We do not run analytics scripts, we do not set advertising or tracking cookies, and this site does not require cookies to function.
5. Purposes and legal bases
For users in the European Economic Area and the United Kingdom, the legal bases under the GDPR / UK GDPR are set out below. Users in Hong Kong are covered by the Personal Data (Privacy) Ordinance, under which we collect personal data only for lawful purposes directly related to our functions and activities.
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the app or game you installed | On-device content, settings | Performance of a contract |
| Operating an optional account | Identifier, credentials, stored content | Performance of a contract |
| Answering support requests | Correspondence, diagnostics | Performance of a contract; legitimate interests |
| Validating purchases and preventing fraud | Transaction receipt | Performance of a contract; legitimate interests |
| Fixing crashes and improving stability | Crash logs shared via Apple | Consent (your device setting); legitimate interests |
| Securing and delivering this website | Technical request data | Legitimate interests (security, availability) |
| Meeting legal, accounting and tax obligations | Transaction records | Legal obligation |
7. International transfers
We are established in Hong Kong, and our providers operate globally. Personal data may therefore be processed outside your country, including in the United States and the European Union. Where data is transferred out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses or an equivalent lawful transfer mechanism operated by the provider concerned. You may request further detail at the address in section 15.
8. Retention
| Category | Retention period |
|---|---|
| Content stored on your device | Until you delete it or remove the app; we hold no copy |
| Optional account data | Until you delete the account, then removed from live systems within 30 days and from backups within 90 days |
| Support correspondence | Up to 24 months after the issue is closed |
| Transaction and accounting records | Up to 7 years, as required by Hong Kong law |
| Website security logs | Retained by Cloudflare per its own retention schedule (short-term) |
9. Security
We apply measures appropriate to the limited data we hold: encryption in transit (HTTPS/TLS) for all traffic to this site and to any of our endpoints, platform-provided encryption at rest on devices, least-privilege access to systems, multi-factor authentication on our developer and hosting accounts, and prompt patching. No system is perfectly secure; if a breach affects you and applicable law requires it, we will notify you and the competent authority without undue delay.
10. Children
Our products are not directed at children under 13 (or the equivalent minimum age in your country) unless a specific title is explicitly published in the App Store Kids Category and states so on its listing. We do not knowingly collect personal data from children. Titles intended for children contain no behavioural advertising and no third-party analytics, in line with Apple's Kids Category requirements and the Children's Online Privacy Protection Act.
If you are a parent or guardian and believe a child has provided us with personal data, contact us and we will delete it.
11. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you, and obtain a copy;
- Correct inaccurate or incomplete data;
- Delete your data (“right to be forgotten”), including deletion of any account;
- Restrict or object to processing based on our legitimate interests;
- Portability — receive your data in a structured, commonly used, machine-readable format;
- Withdraw consent at any time, where processing is based on consent;
- Not be discriminated against for exercising privacy rights (California);
- Complain to a supervisory authority — in Hong Kong, the Office of the Privacy Commissioner for Personal Data; in the EEA/UK, your local data protection authority.
To exercise any of these, email dev@pandarentrading.com. We respond within 30 days. We may ask you for information to verify your identity before acting, and we will not charge you for a first request.
12. Apple platform specifics
App Tracking Transparency
We do not track users as Apple defines tracking, and therefore our apps do not present the tracking permission prompt. If this ever changes for a particular product, that product will request your permission explicitly and its listing will be updated before release.
App Privacy labels
The “App Privacy” section of each App Store listing summarises the data each product collects. We keep those labels accurate and update them with every release that changes data handling. Where a label and this policy appear to conflict, contact us — we will correct whichever is wrong.
Sign in with Apple
Where an account is offered alongside third-party sign-in, we also offer Sign in with Apple, and we support Apple's private email relay. Choosing it means we never see your real address.
13. This website
pandarentrading.com is a static site. It sets no cookies, loads no third-party fonts, scripts, pixels or embeds, and sends no data to analytics providers. The only scripts served are our own, from this domain. External links (for example to Apple) are marked, and once you follow them the destination's own privacy policy applies.
14. Changes to this policy
We may update this policy as our products evolve or the law changes. The version number and dates at the top of this page always reflect the current text. For material changes we will give notice in the affected app or on this website before the change takes effect, and where the law requires it we will ask for your consent again.
15. Contact
Questions, requests and complaints about privacy go to dev@pandarentrading.com, or by post to:
PANDAREN TRADING LIMITED
Rm 22B, 22/F, Kiu Yin Commercial Building
361–363 Lockhart Road, Wan Chai
Hong Kong