Privacy Policy
This Privacy Policy explains how the Hang Drum Android app distributed through Google Play, Cafe Bazaar, or Myket by Vanguard Knight handles information.
1. Overview
Hang Drum does not provide a user account or login system. Its preferences, saved melodies, and unlock records stay in app-private storage. Saved melody names and content, recorded note/timing sequences, instrument/audio interaction content, microphone recordings, and user-entered text are not included in Vanguard Knight product telemetry or uploaded by the current implementation.
When remote content functionality is enabled for a release, the Google Play build may contact Vanguard Knight-operated services to retrieve the corresponding asset catalogs and download eligible backgrounds, skins, and Ambient audio. The app checks remote content locally before use. The Google Play build may send limited first-party product and app-usage event requests after relevant actions, as described below. First-party analytics collection is currently enabled server-side for Google Play, and accepted Play events are aggregated. For other distributions, collection depends on the features enabled for that release. If collection is disabled or an event is not accepted, product functionality does not depend on analytics acceptance.
2. Information stored locally
Hang Drum stores information in app-private storage on your device so the application can remember your choices and features. This can include:
- instrument style, background, scale, notation, font, and ambient-wave preferences;
- saved melody information, including the name you choose and the recorded note/timing sequence;
- asset selection and lock or unlock state; and
- temporary rewarded-unlock records and expiry timing.
The underlying preference and entitlement records are stored locally. For Google Play, limited first-party events may report an asset selection or unlock activity as described below; the preference or entitlement records themselves are not uploaded. Saved melodies are not uploaded or included in product telemetry. You can delete saved melodies inside the app. Android also lets you clear an app's local storage or remove the app from your device.
3. Vanguard Knight content and product analytics
When remote content features are enabled, the Google Play build may request a catalog and download eligible remote backgrounds, skins, or Ambient audio. Downloaded files are checked on the device against expected size and SHA-256 information and validated for their expected image or audio type before use. Remote content is separate from saved melodies.
The Google Play release attempts to send first-party product events for asset selection, unlock grants or expiry, unlock-dialog activity, and rewarded-ad requests or rewards. Where remote-download or Ambient features are enabled, verified or failed asset downloads and Ambient playback-start events may also be sent. These best-effort requests do not block app features. First-party analytics is currently enabled for Google Play, and the backend aggregates accepted Play events. If the service is configured not to collect analytics or an event is not accepted, that event is not stored and app functionality does not depend on analytics acceptance. Product-event payloads contain a random per-event UUID, app distribution, app version, event type, and asset type and ID where applicable. A remote-download event may also contain verified byte length, a bounded duration, and a typed failure code.
Separate app-usage markers can record the first successful usable Home presentation and a daily, weekly, or monthly activity marker when the app is used in a new UTC period. A first-activation marker is not an official store install; clearing app data or reinstalling can allow another marker. Usage-event payloads also contain app version name and code, device manufacturer and model, Android version and API level, and the app's effective language. The app does not send a client event timestamp or country. The service may derive a coarse country from request network information when configured.
Current Hang Drum builds use only play, bazaar, and myket as first-party event distribution values for Google Play, Cafe Bazaar, and Myket. The Admin App Analytics source (APP_TELEMETRY) reports aggregates from those app-submitted events; the event counts are not official store installation or activity reports. Official Google Play Console aggregates (PLAY_CONSOLE) are separate provider data and are not derived from app telemetry. Official Cafe Bazaar Console (BAZAAR_CONSOLE) and Myket Console (MYKET_CONSOLE) reports, if used, are also separate provider data; they are not part of APP_TELEMETRY, and no official Bazaar or Myket console metrics are currently imported.
The first-party telemetry payload does not contain a stable user or account ID, a stable installation ID, Android ID, advertising ID, Firebase Installation ID, FCM registration token, or device serial. Its random per-event UUID is used only to prevent duplicate counting; it is not a user or device identifier. Saved melody names or content, recorded note sequences, instrument/audio interaction content, microphone recordings, and user-entered text are not part of these events.
The backend currently folds accepted Google Play product events into daily aggregate records rather than keeping an event-history table. The random event identifier is held separately for duplicate prevention for up to 47 hours. Aggregate operational and product reports may be viewed in a restricted administrative dashboard.
4. Network information and coarse country
Network infrastructure necessarily receives ordinary connection information, including an IP address, when a request is made. The first-party Hang Drum service may process the network address transiently for operational purposes such as rate limiting. The raw address is not stored in the Hang Drum analytics database. Production GeoIP enrichment is currently disabled, so the country value for Play analytics resolves to the unknown ZZ bucket. If GeoIP is enabled in the future, the service may derive a coarse country from the network address and store the country code with daily aggregate totals.
Hang Drum product telemetry does not include GPS coordinates or precise device location, and country is not obtained from device GPS. Generic web-server, host, system-journal, or network-provider logs are a separate matter and have not been fully production-audited; we do not make a blanket claim about their contents or retention.
5. Google Play advertising
The Google Play build uses Google's User Messaging Platform (UMP) for consent and privacy messaging and Google Mobile Ads (AdMob) for rewarded advertising. The app requests updated consent information and, where required, presents Google's consent form and privacy options. Google Mobile Ads is initialized only when the app's UMP consent gate reports that ad requests are allowed; a rewarded ad request follows a user action. UMP's choices and available messages can depend on Google's configuration and the user's region.
Google says the Google Mobile Ads SDK may automatically collect or share information such as IP address, product interactions, diagnostic information, and device or account identifiers (including advertising-related identifiers) for advertising, analytics, and fraud prevention. This is Google's separate SDK processing. Advertising identifiers are not sent in Vanguard Knight's first-party product telemetry. The exact SDK version and configuration must be checked for the distributed build.
For details, see Google's Google Mobile Ads data disclosure and Google Privacy Policy.
The Cafe Bazaar and Myket builds include Tapsell Plus for optional rewarded advertising. The app can request and show a rewarded ad after a user action. Tapsell's processing for advertising is separate from Vanguard Knight's first-party telemetry and is governed by the provider's own privacy practices.
6. Network access
Hang Drum can access the internet and network-state information for remote content, first-party product-event requests from supported app distributions, Google consent and advertising services in the Google Play build, and Tapsell rewarded advertising in Cafe Bazaar and Myket builds. First-party service requests use HTTPS, and the app's network-security configuration disallows cleartext HTTP.
7. Permissions and identifiers
For Google Play, the app declares permissions for internet access, network-state access, and Android notifications (POST_NOTIFICATIONS). Google Play does not declare permission to change network state. Other store versions may include additional network-state permissions where required for their current features. The app does not declare GPS or location permissions. On Android 13 and later, after Home is ready and the app is active, Hang Drum may show Android's system notification permission prompt when startup privacy UI is inactive and no conflicting app modal is active. You can choose to allow or decline. Declining does not block core app use. Hang Drum makes this request only once and does not repeatedly prompt after that attempt. Users can also disable notifications in Android settings. This permission controls whether notifications may be displayed. Denying it does not itself disable Firebase registration.
The app uses Firebase Cloud Messaging (FCM) for product and developer updates and announcements. Promotional or advertising push campaigns are not used in this release; if that use changes, the privacy and Data Safety disclosures will be reviewed before it begins. Firebase Messaging can automatically create and refresh a per-installation Firebase Installation ID (FID) and related messaging registration information with Google/Firebase so the installation can receive messages. The current app implementation does not retrieve or upload its FCM registration token to Vanguard Knight's first-party API, and it does not subscribe to FCM topics. This Firebase registration is separate from first-party telemetry, which does not contain the FID or FCM token.
When a notification message arrives in the foreground, the app can display it if Android permits notification display. In the background, FCM or Android may display a notification message. The app ignores data-only FCM messages. In the Google Play build, Google Mobile Ads can contribute advertising-ID permission metadata through manifest merging. Advertising identifiers are handled by the advertising SDK and Android platform subject to user and platform controls, separately from first-party product telemetry.
8. Google Play aggregate reports
Vanguard Knight may use aggregate reports supplied by Google Play, such as install statistics, for product reporting. These reports are aggregate information and are not used to create a persistent Hang Drum user ID. Install statistics are not treated as daily or monthly active users; those measures are reported only if an authoritative source provides them.
9. Retention and deletion
Local app records remain in app-private storage until they are changed, deleted through an available app feature, cleared using Android's app-storage controls, or removed with the app as applicable. Hang Drum has no user account, so there is no Vanguard Knight account to delete.
Google Play first-party analytics records are folded into daily aggregates and retained for 24 months. Random event UUIDs used only for retry and duplicate prevention are kept separately for up to 47 hours. Automated maintenance removes records according to these configured periods. Imported Google Play report aggregates are stored separately from app telemetry and use the configured cutoff when aggregate maintenance runs; the reviewed source does not establish a separate period for their import-deduplication metadata. Retention for general infrastructure logs has not been fully production-audited.
Hang Drum has no first-party user account or stable user identifier attached to telemetry, and the app provides no account-linked server telemetry deletion flow. Clearing app data or uninstalling removes local app data; it does not delete server aggregates or information held by Google or other providers. Contact us with privacy questions, but do not assume that aggregate or provider records can be individually deleted through the app.
Information processed by Google or other third-party providers is retained according to those providers' own policies. Vanguard Knight does not set an independent retention period for data held solely by those providers.
10. Security and other third-party services
Vanguard Knight's first-party app service requests use HTTPS, and the app disallows cleartext HTTP. Google and other third-party services are responsible for information they process in their own systems. A service being included as a software dependency does not mean Vanguard Knight directly receives all information that the service may process.
11. Changes to this Privacy Policy
This policy may be updated when Hang Drum's features, service providers, or legal requirements change. The date at the top of this page identifies the latest published version.
12. Contact and privacy inquiries
For privacy questions about Hang Drum, use the developer contact channel shown on the official store listing from which you obtained the app and identify Hang Drum. General support information is available on the Vanguard Knight support page.