Privacy Policy — TV Digital Signage Ads

Company: Univerza | Application: TV Digital Signage Ads (Android TV) | Package: com.mrfox.signage_ads | Effective date: September 15, 2026 | Document version: 1.1.0

1. Scope

This policy covers only the TV Digital Signage Ads application running on Android TV devices — a display client for the Digital Signage Advertisement Marketplace — and the web-based sign-in step the app opens for QR code scanning during authentication.

This policy does not cover the marketplace backend (slot inventory, pricing, billing), the separate advertiser app (where businesses sign up, purchase ad slots, upload media, and pay), or the Admin console — each is a separate service that should have its own privacy policy.

2. Who This Policy Protects

This app is installed on public-facing screens — e.g. shopping malls, hospitals, hotels, or offices — to play the ad playlist the marketplace backend assembles. "User" in this policy means the administrator or site owner who registers and manages the device, not members of the public who happen to view the screen, and not advertisers who purchase slots through the separate advertiser app.

The app has no camera, no viewer-detection sensor, and no mechanism that collects data from people looking at the screen. Display is strictly one-way.

3. Data We Collect and Use

Data	Source	Purpose	Shared With
Administrator's Google account — Google UID, email, display name, profile photo, email-verified status	Admin scans the QR code and signs in with Google on a mobile phone	Verify the identity of the person authorized to manage the device	Google Firebase Auth
Authentication tokens (access / ID / refresh token)	Generated after successful login	Keep the session signed in without re-authenticating	Not shared — stored encrypted on-device only
Device identifier — an ID derived from the Android ID (not a real hardware MAC address), device model/manufacturer, app version	Read/generated by the app on the TV itself	Pair and approve the device with the backend; prevent spoofed devices	Univerza / marketplace servers
Installation site/location, as set by the admin	Entered via the web portal during device registration	Schedule the correct ad playlist to the correct installation point	Univerza / marketplace servers
Location coordinates (latitude/longitude) — optional	Sourced from session data when the admin signs in with Google, then cached on-device — the app does not use GPS or request Android's location permission	Keep the registered site's coordinates in the backend up to date, without re-registering the device	Univerza / marketplace servers
Playback/heartbeat status — current schedule ID, playback position, device status, the admin account ID linked to the device	Sent automatically by the app roughly every 30 seconds	Track device status in real time, and keep the ad playlist/booking schedule in sync	Univerza / marketplace servers
Booked ad start/completion reports (tied to a booking/assignment ID)	Reported automatically by the app when a booked ad slot starts and finishes playing	Confirm playback for billing, and prevent incorrect no-show refunds in the marketplace	Univerza / marketplace servers
Network status (online/offline, Wi-Fi)	The TV device	Switch to cached content when there is no internet connection	Not shared — not stored persistently
App usage logs (login events, screen views, ad playlist playback, site ID, device model)	Firebase Analytics SDK	Measure and improve service reliability	Google Firebase Analytics
Error/crash logs (stack traces, device model/OS version, custom keys such as site_id, session_id)	Firebase Crashlytics SDK	Diagnose and fix app issues	Google Firebase Crashlytics
Displayed ad content (images/videos assembled by the marketplace backend)	Downloaded from Univerza / marketplace servers	Display the booked ad playlist, and when a slot is open, show a QR code inviting businesses to book it	Not personal data

The identifier the system labels a "MAC address" is actually computed from the device's Android ID (SHA-256 derivation), because Android 10+ no longer allows ordinary apps to read the real hardware MAC address. It is therefore not a permanent hardware identifier in the traditional sense, but a value tied to the (signing key + user + device) combination, per Android's own restrictions.

The location coordinates above are not collected via GPS or any location sensor on the device — the app never requests Android's location permission — but come from data already included in the session when the admin signs in, and are only sent onward when both a latitude and longitude value are present.

4. On-Device Permissions

The app requests only the Android TV permissions needed for network connectivity and continuous playback:

• INTERNET — Connect to the server to fetch content schedules and sync in real time
• ACCESS_NETWORK_STATE — Check online/offline status to switch to offline mode
• ACCESS_WIFI_STATE — Read the TV's Wi-Fi connection status
• CHANGE_WIFI_STATE — Keep the Wi-Fi connection stable during playback
• WAKE_LOCK — Prevent the screen/system from sleeping during content playback

The app does not request: camera, microphone, location (GPS), contacts, SMS, or external storage — none of these are accessed in any version of the app.

5. Sharing With Third Parties

We do not sell or rent user data to third parties for marketing purposes. Data is sent only to the following service providers, and only as needed for the app to function:

• Google Firebase (Authentication, Realtime Database, Analytics, Crashlytics) — acts as our data processor, under Google's Privacy Policy
• Univerza / marketplace servers — store device data, ad playlists, booking/playback records, and marketplace registration status

6. Retention and Deletion

• Account data, tokens, device identifiers, and location coordinates are retained for as long as the device remains registered, and are deleted when the admin logs out/deregisters, or when an admin removes the device from the backend system.
• Admins may request deletion of a device and its linked data at any time via the contact channel in Section 12.

Retention periods for Firebase Analytics and Crashlytics logs depend on the actual settings of the Firebase project this app uses — Google's general defaults are roughly 14 months for Analytics and up to 90 days for Crashlytics

7. Security Measures

• Authentication tokens and the device key are stored encrypted via Android Keystore-backed secure storage, not as plain text.
• All data transmitted between the app and the server is encrypted over HTTPS/TLS.
• The development team follows an internal practice of not sending passwords or tokens directly to the error-logging system (Crashlytics).

8. Children

This app is designed for administrators and businesses installing public-facing displays. It is not directed at children, and we do not knowingly collect personal data from children. If we learn that data has been inadvertently collected from a child, please contact us so it can be deleted.

9. Advertising Content and Advertising ID

This app's core function is to display third-party advertisements purchased through the Digital Signage Advertisement Marketplace. Even so, this app does not use the Google Advertising ID (AD_ID) and does not embed a mobile advertising SDK (such as Google AdMob) to select, target, or track those ads — this permission is explicitly disabled in the app's configuration. Ad content is delivered to the app as ordinary media from the marketplace backend, the same as any other scheduled content. Advertiser sign-up, ad slot purchase, payment, and media upload all happen in a separate advertiser app, not within this Android TV app.

10. Data Subject Rights

Administrators who sign in with a Google account have the right to:

• Request access to, or a copy of, the data we hold about them
• Request correction of inaccurate data
• Request deletion of their device account and linked data
• Revoke the app's access to their Google Account at myaccount.google.com/permissions

11. Changes to This Policy

We may update this policy when features or services change in ways that affect the data we collect. The "Effective date" at the top of this document will be updated whenever a material change is made.

12. Contact Us

For questions about this policy, or to exercise your data rights, contact:

• Company: Univerza Co., Ltd.
• Email: developer@univerza.co