Privacy Policy & Data Protection

1. Zero-Telemetry & Cryptographic Privacy Philosophy

At Mega AppStore, privacy is not merely a legal compliance mandate—it is engineered into our platform architecture. Unlike conventional app marketplaces, we strictly reject ad-tracking SDKs, third-party behavioral profiling pixels, and cross-site telemetry networks.

2. Information We Collect

We only collect data necessary to provide software distribution, authenticate your identity, and disburse digital rewards:

• Account Credentials: Email address, encrypted password hash (Argon2id/Bcrypt), display name, and Multi-Factor Authentication factors (FIDO2 WebAuthn credential public keys or TOTP secret seeds).
• Device Architecture Headers: Client User-Agent string parsed strictly in ephemeral memory to recommend compatible binary formats (e.g. Android ARM64, macOS Apple Silicon, Windows x64). We do not fingerprint hardware serials or IMEI numbers.
• Digital Wallet & Payout Data: Point balance records, referral attribution codes, and payout destinations supplied by you (e.g. Bank IBAN, PayPal address, Wise email, USDT wallet address, or Mobile Money phone number).
• Security & Audit Logs: Timestamped IP address hashes and security event records (e.g., failed logins, passkey registration, session revocation) retained to detect malicious intrusion and brute-force attacks.

3. How We Process Data & Purpose of Use

We process your personal data strictly for the following operational purposes:

1. Delivering authentic, signed binary software packages matching your client runtime.
2. Securing developer publishing consoles through FIDO2 hardware passkey challenge verification.
3. Managing the Mega Points digital rewards ledger and processing cashout withdrawals via designated financial rails.
4. Preventing bot attacks, sybil referral rings, and counterfeit APK distributions.
5. Complying with statutory financial reporting, anti-fraud, and AML obligations.

4. Legal Bases Under GDPR & International Standards

If you reside in the European Economic Area (EEA), United Kingdom, or Switzerland, our processing of your personal data is justified under the following legal bases:

• Performance of a Contract (Art. 6(1)(b) GDPR): Managing your account, downloading applications, and executing point payouts.
• Legitimate Interests (Art. 6(1)(f) GDPR): Protecting binary integrity, detecting malware, and preventing platform abuse.
• Legal Obligation (Art. 6(1)(c) GDPR): Maintaining financial audit trails for digital fiat disbursements.
• Consent (Art. 6(1)(a) GDPR): Where you explicitly opt into email product announcements or beta testing updates.

5. Encryption & Security Posture

We maintain defense-in-depth security to safeguard your data at rest and in transit:

• Transport Security: All API and download traffic is strictly enforced over TLS 1.3 with HSTS and Perfect Forward Secrecy.
• Data at Rest: Database volumes are encrypted using AES-256. Sensitive financial payout details are stored within hardware security modules or encrypted database partitions.
• Cryptographic Salting: Passwords and passkey challenges utilize modern cryptographic primitives with unique per-user salts.

6. Third-Party Data Processors

We share data only with trusted infrastructure subprocessors strictly as necessary to execute platform services:

• Cloud Edge & Storage: Highly secure edge distribution networks for artifact caching.
• Payment & Payout Rails: Authorized banking institutions, PayPal Inc., Wise PLC, and blockchain networks (for USDT transfers) to disburse cashout requests.
• Transactional Email: SMTP gateways delivering authentication OTP codes and password reset challenges.

7. Cookies & Local Storage

Mega AppStore uses only strictly necessary cookies and local storage tokens. We do not use third-party analytics cookies, Google Analytics, or advertising trackers. Read our detailed Cookie Policy for token specifications.

8. Your Rights & Self-Service Privacy Tools

Under GDPR, CCPA/CPRA, and international privacy laws, you possess the following rights:

• Right of Access & Portability: Obtain a complete copy of all stored personal records in structured JSON format.
• Right to Rectification: Update your name, credentials, or avatar via your account dashboard.
• Right to Erasure ("Right to be Forgotten"): Permanently delete your account, authentication factors, and personal associations.
• Right to Object & Restrict Processing: Request suspension of specific processing activities.

9. Data Retention & International Transfers

We retain your personal data only for as long as your account remains active. Upon initiating account deletion, all personal data is permanently purged from active databases within forty-eight (48) hours, except where retention is legally mandated by financial bookkeeping laws.

10. Children's Privacy (COPPA Compliance)

Mega AppStore is not directed toward children under thirteen (13) years of age (or sixteen in the EEA). We do not knowingly collect personal information from children. If we discover a child under thirteen has provided us personal data, we will immediately delete such records.

11. Data Protection Officer (DPO) & Contact

If you have inquiries, complaints, or wish to exercise your statutory privacy rights, contact our Data Protection Officer: