BambooMobi

Privacy Policy — Bamboo AdMob Sync

Effective date: 21 October 2026  ·  Last updated: 22 October 2026  ·  Version 2.0

This page is publicly accessible — no account or login is required to read it.

1. Who we are (data controller)

Bamboo AdMob Sync ("the Application") is an internal advertising reporting and data-synchronisation tool operated by BambooMobi ("we", "us", "our"). BambooMobi is the data controller for the information described in this policy.

Controller	BambooMobi
Contact for privacy matters	tangzhang657@gmail.com
Application home page	https://admob.bamboomobi.top/app-info.html
Application type	Internal tool (not offered to the general public; no sign-up, no consumer accounts)

2. Scope of this policy

This policy explains what information the Application accesses through Google's AdMob API, why we access it, how it is stored and protected, who it is shared with, how long it is kept, and how the person who granted access can withdraw it. It applies to the Application only — it does not describe any other BambooMobi service.

3. Data we access

The Application connects to the Google AdMob API using OAuth 2.0 with the single scope https://www.googleapis.com/auth/admob.readonly — a read-only permission. We access the following categories of data, and only for AdMob accounts that BambooMobi owns and operates.

3.1 Advertising performance report data

Category	Specific fields	Why we need it
Time dimension	Report date	Placing each figure on the correct calendar day for daily reporting and reconciliation
App identifiers	App ID (e.g. ca-app-pub-…~5060919207), app display name	Attributing revenue and traffic to the correct app we publish
Ad unit identifiers	Ad unit ID, ad unit display name, ad unit format (interstitial / native / app-open / banner)	Understanding which in-app placements perform, and diagnosing fill or rendering problems
Geography	Country / region code	Country-level analytics; detecting anomalies such as a single country dominating traffic
Platform & ad source	Platform (Android / iOS), ad source name (e.g. AdMob Network)	Comparing platform performance and verifying mediation configuration
Aggregated metrics	Ad requests, matched requests, match rate, impressions, clicks, click-through rate, impression CTR, estimated earnings, observed eCPM	Producing revenue reports, financial reconciliation against our accounting records, and traffic-quality review

3.2 Account metadata

Category	Specific fields	Why we need it
Account identity	AdMob publisher ID (e.g. pub-7685469950198623), linked AdSense customer ID	Ensuring reports are attributed to, and only to, the correct account
Reporting settings	Account time zone, account currency	Preventing off-by-one-day errors and currency misinterpretation in our reporting
Asset inventory	List of apps and ad units with their serving status	Detecting removed or renamed ad units so historical figures stay correctly labelled

3.3 Authorisation artefacts

Item	What it is	Why we hold it	Where it is stored
OAuth refresh token	A credential issued by Google that allows the Application to obtain short-lived access tokens for the read-only scope, without repeated manual sign-in	To keep the authorised integration running	Root-owned environment file with 0600 permissions on our own proxy server; never written to our application database, source code repository or logs
OAuth access token	A short-lived token (about one hour) held in memory on the proxy server	To call the read-only reporting endpoints	In process memory only; discarded on expiry or restart

4. Data we do not access

• We do not access, request or store your Google Account profile: no name, photo, email address, contacts, calendar or files.
• We do not request any scope for Gmail, Google Drive, Google Calendar, YouTube, Google Analytics, Google Ads or Google Play — only admob.readonly.
• We do not collect personal data of the end users of any app: no names, email addresses, device identifiers, advertising IDs (IDFA/GAID), IP addresses, precise location, or in-app behaviour. The AdMob reporting API returns aggregated statistics only.
• We do not access payment, tax or banking information held by Google, and we do not initiate payouts.
• We do not use the data for advertising targeting, audience segmentation, profiling, credit scoring or resale.
• We do not sell data and we do not use it to train machine-learning models.

5. How and why we use the data

1. Revenue reporting — to see daily earnings by app, ad unit, country and format, and to compare them with our own accounting records.
2. Financial reconciliation — to identify discrepancies between platform-reported earnings and internally recorded revenue.
3. Traffic-quality review — to spot unusual patterns (for example a sudden drop in match rate, or an unexpected concentration of traffic in one country) that may indicate a technical or compliance problem.
4. Pipeline integrity checks — to verify that data retrieved from the API was stored completely and without duplication (the Application compares repeated retrievals of the same period and flags differences).
5. Operational alerting — to notify our own staff if authorisation expires or a scheduled retrieval fails.

All of these purposes are internal business-reporting purposes. The data is never used to make decisions about individuals, and the Application performs no automated decision-making and no profiling of individuals.

6. Legal bases

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases:

• Legitimate interests (Art. 6(1)(f)) — measuring and reconciling the performance of advertising inventory that we ourselves operate, which is a necessary and expected part of running our business, and which does not involve personal data of end users.
• Consent (Art. 6(1)(a)) — for the OAuth authorisation itself, which is granted explicitly by the account owner through Google's consent screen and can be withdrawn at any time.
• Legal obligation (Art. 6(1)(c)) — where we must retain records for accounting or tax purposes.

7. Sharing and processors

We do not sell, rent or trade the data. We share it only in the limited circumstances below.

Recipient	Purpose	Notes
Our own staff	Reporting, reconciliation and operations	Access limited to authorised personnel on a need-to-know basis, over authenticated channels
Cloud hosting provider (data processor)	Running our database and proxy server	Acts only on our documented instructions; no independent use of the data
Account owner / contractual partners	Settlement of advertising revenue	Aggregated figures only — app-level totals; no personal data, and no Google account credentials
Authorities	Compliance with a legal obligation	Only where we are legally required to disclose

No data is shared with advertising networks, data brokers, or analytics resellers.

8. International transfers

The Application's proxy server and database are hosted in Hong Kong. Data retrieved from Google may therefore be processed outside the country in which it was generated. Where personal data of an EU/UK data subject would be involved (in practice this policy covers only aggregated advertising statistics), transfers are protected by appropriate safeguards such as standard contractual clauses. The Application also enforces TLS for every connection to Google's API, so data is encrypted in transit.

9. Retention

Data	Retention period	Reason
Advertising report data (daily aggregates)	Up to 36 months, then deleted or irreversibly aggregated	Financial reconciliation, audit and year-on-year comparison
Retrieval logs (job status, row counts, error messages)	90 days, then automatically purged	Operational troubleshooting
OAuth refresh token	Until the integration is discontinued or access is revoked; deleted immediately afterwards	Maintaining the authorised connection
Web server access logs for this public information site	14 days	Security and abuse monitoring

10. Security measures

• Least privilege — only the read-only AdMob scope is requested; the Application has no write capability on any Google product.
• Credential isolation — OAuth client secret and refresh token exist only in a root-owned 0600 environment file on a dedicated proxy server; they are never committed to source control, never stored in the application database, and never written to logs or error messages.
• Network isolation — the proxy that talks to Google accepts requests only from our own reporting server, authenticated with a shared secret header; the public pages you are reading are served by a separate static web server that holds no credentials.
• Encryption in transit — TLS is enforced for all API calls to Google and for this website (HTTPS with automatic certificate renewal).
• Access control — database and server access is restricted to named administrators using key-based authentication; no shared accounts.
• Monitoring — automated checks run daily and alert staff if authorisation expires or scheduled retrieval fails.
• No secret in the browser — the Application is a server-side integration; no Google credential is ever delivered to a web browser or mobile app.

11. Cookies and tracking

This website and the Application use no cookies, no local storage, no tracking pixels, no third-party analytics and no advertising tags. We do not build behavioural profiles and we do not track visitors across sites. Server access logs record standard technical fields (timestamp, requested path, HTTP status, user agent) for security purposes only, and are deleted after 14 days.

12. Children

The Application is an internal business tool. It is not directed to children, is not offered to the public, and we do not knowingly collect any information relating to children. The AdMob statistics we process are aggregated advertising metrics relating to apps we publish, not information about individual users.

13. Your rights

Where EU/UK data protection law applies, you have the right to:

• be informed about the processing (this policy),
• request access to any personal data we hold about you,
• request correction of inaccurate data,
• request erasure of your data,
• request restriction of, or object to, processing,
• request data portability,
• withdraw consent at any time (this does not affect processing carried out before withdrawal),
• lodge a complaint with your local supervisory authority.

To exercise any of these rights, email tangzhang657@gmail.com. We respond within 30 days. We may need to verify your identity, and we may ask for the AdMob account in question so that we can locate the relevant records. Because the Application processes aggregated advertising statistics, in most cases we hold no personal data about an individual to disclose, correct or erase.

14. Revoking Google access

Access can be withdrawn at any time, with immediate effect, in either of two ways:

1. Self-service (recommended). Go to myaccount.google.com/permissions, select Bamboo AdMob Sync, and choose Remove access. The Application will no longer be able to retrieve any data from the moment you revoke it.
2. By contacting us. Email tangzhang657@gmail.com and we will revoke the authorisation and delete the stored refresh token from our proxy server.

After revocation, previously retrieved historical figures may remain in our reporting database until the retention period in section 9 expires, unless you ask us to delete them.

15. Automated decision-making and profiling

The Application does not carry out automated decision-making within the meaning of Art. 22 GDPR, and does not build profiles of individuals. Automated processes are used only to retrieve, store and reconcile aggregated advertising statistics.

16. AI-generated content statement

The Application does not use Google APIs — and does not use any other service — to create, generate, distribute or facilitate AI-generated Non-Consensual Intimate Imagery (AI NCII) or any other form of synthetic sexual or intimate content. The only Google data the Application handles is aggregated advertising performance statistics for accounts we own, and its only purpose is internal financial reporting.

17. Changes to this policy

If we change how the Application handles data, we will update this page and revise the "Last updated" date at the top. Material changes will also be reflected in the Google OAuth consent screen configuration. Continued use of the Application after an update constitutes acceptance of the revised policy.

18. Contact

BambooMobi — privacy contact
Email: tangzhang657@gmail.com
We aim to respond to privacy enquiries within 30 days. If you are not satisfied with our response, you may complain to your local data protection authority.

Related documents: Application information · Terms of Service