Privacy Policy

Welcome to McDong Extension. We deeply value your privacy and always adhere to the data minimization principle. This Privacy Policy explains clearly and transparently how we handle your information: We never proactively collect any personal private data. Only for Premium version users, limited account and verification information is collected as strictly necessary, and we implement robust security safeguards.

2. We Do Not Proactively Collect Your Private Information

The Extension is designed according to the principle of minimal necessity. Without your explicit consent or when not required to provide the service, we do not proactively collect, upload, or store any information that would compromise your personal privacy, including but not limited to:

• Name, address, phone number, payment card information;
• Browser cookies, browsing history, visited URLs, web page content, or form entries;
• Private hardware identifiers (e.g., hard disk serial number, motherboard ID, MAC address);
• Biometric or social information that can uniquely identify a natural person.

The Extension contains no analytics scripts, third‑party tracking beacons, background monitoring routines, or advertising SDKs. The only exception applies when you voluntarily purchase and activate the Premium version – in that case, we inform you of the limited information collected (as described in Sections 3 and 4) and obtain your authorization.

3. Premium Version – License Validation and Account Information

The following data collection applies only to users who have activated the Premium version. The free version is completely exempt. If you have never purchased or activated the Premium version, no such data will be generated.

3.1 Anonymous Device Hash ID (Required)

To bind your Premium license and prevent unauthorized copying, the Extension generates a salted, one‑way cryptographic hash value based on the extension installation environment (non‑reversible). This hash ID:

• Is fully anonymous – cannot be traced back to your real identity, specific device, or daily browsing behaviour;
• Is uploaded only once when you activate the Premium license (or manually re‑activate);
• Is used solely to verify the license validity, enforce device limits, and prevent malicious sharing.

3.2 Account Registration Information (email, encrypted password, device ID) – if account features are provided

If the Premium version provides account registration/login features (e.g., syncing license status or preferences across devices), we collect the following essential information:

• Email address: as your unique account identifier for login, password recovery, and important service notifications;
• Password: stored using a strong hashing algorithm (bcrypt/scrypt) – no one (including internal staff) can read the plaintext;
• Device ID: an anonymous identifier associated with your account, used only for security verification (e.g., detecting abnormal logins, preventing account theft), never for tracking or analytics.

This information is collected only when you actively register, log in, or voluntarily associate a device and is stored securely on our license servers located in [Singapore / United States / EU] (the actual location may be adjusted for service optimization, but always with equivalent safeguards).

4. Account Security and Necessary Verification Information

To protect your Premium account security and prevent unauthorised logins or fraudulent activities, we may record and verify the following necessary technical information when you log in, activate, or use your Premium account:

• IP address: used temporarily for security analysis (e.g., detecting abnormal login locations, preventing credential stuffing). It is not linked to your browsing activity and will be periodically anonymised after security checks are completed;
• Device hash ID: as described in Section 3.1, this anonymous device hash is used to recognise trusted devices, enforce concurrent device limits, and help you identify suspicious devices in case of account anomalies.

The information above will never be used for any form of user profiling, advertising, or behavioural analysis. We process this data solely based on our legitimate interest in account security and service integrity (GDPR Article 6(1)(f)). You may request us to stop collecting and delete this verification information at any time by cancelling your Premium account.

We routinely rotate security logs containing IP addresses (retained for no more than 90 days). The retention rules for device hash IDs follow the same period as your license validity (see notes in Section 3).

5. Data Storage, Transfer and Sharing

Storage location: Data associated with the Premium version is stored on cloud servers. The actual physical location may vary according to service optimization and redundancy requirements. However, all storage regions are subject to applicable data protection laws and we ensure consistent safeguards regardless of location.

Data transmission: All communication with our servers uses TLS 1.3 encryption. We do not sell, rent, or share your personal information with third parties for their own purposes. The only rare exceptions are:

• When required by law, judicial process, or governmental request;
• When reasonably necessary to protect the rights, property, or safety of McDong, our users, or the public.

Cross‑border transfer notice: Because our cloud infrastructure may involve servers in different countries, your information may be transferred across borders. If you are located in the European Economic Area (EEA), the United Kingdom, or other regions with specific data transfer requirements, we will implement appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) or equivalent mechanisms to ensure your data receives an adequate level of protection.

6. How We Protect Your Data Security

We use industry‑leading technical and organisational measures to protect server‑side data against unauthorised access, disclosure, alteration, or loss:

• Encrypted storage: Passwords are stored using strong cryptographic hashes (bcrypt + random salt). Device IDs and hash IDs are one‑way hashed and cannot be reversed by the server.
• Access control: Only a very limited number of authorised operations and development personnel can access server data under the principle of least privilege, strictly for troubleshooting and security maintenance, with all actions logged.
• Data isolation: The free version transmits no data; different users’ license and verification data are logically isolated at the application layer.
• Regular security audits: We perform quarterly vulnerability scans, penetration tests, and dependency reviews to address security gaps promptly.

Nevertheless, no method of transmission over the Internet or electronic storage is 100% secure. If a data security incident occurs, we will fulfill notification obligations within the legally required timeframe (typically 72 hours) and report to the relevant supervisory authority.

7. Your Rights and Control

Under the GDPR, CCPA, China’s Personal Information Protection Law, and other applicable laws, you have the following rights regarding your personal information:

• Right to be informed: to understand what information we collect and how it is processed (this Policy fulfills that).
• Right of access: to request a copy of your personal data held by us.
• Right to rectification: to correct inaccurate or incomplete personal information (e.g., email address).
• Right to erasure (“right to be forgotten”): under certain conditions, to request deletion of your personal information (e.g., when you withdraw consent and no other legal ground for retention exists).
• Right to restriction of processing: under certain circumstances, to request that we suspend processing of your data.
• Right to data portability: to receive the personal data you provided in a structured, commonly used, machine‑readable format and transmit it to another controller.
• Right to withdraw consent: where processing is based on consent, you may withdraw your consent at any time (withdrawal does not affect the lawfulness of processing based on consent before its withdrawal).
• Right to object: if we process based on legitimate interests and you believe it conflicts with your fundamental rights, you may object. We will stop processing unless we demonstrate compelling legitimate grounds.
• Right not to be subject to automated decision‑making: we do not currently use any automated decision‑making (including profiling) that produces legal or similarly significant effects.
• Right to lodge a complaint with a supervisory authority: if you believe your data protection rights have been violated, you may file a complaint with your local data protection authority.

How to exercise your rights?

You may contact us by email at support@mcdong.com with the subject line “Privacy Rights Request”. We will provide a substantive response within 30 days. When necessary, we may ask you to provide verification information (such as the email address associated with your account) to confirm your identity.

8. Children’s Data Protection

Our product and Extension are not intended for individuals under the age of 16. We do not knowingly collect any personal information from children under 16. If you are a parent or guardian and discover that a child has used the Premium version and provided information without your consent, please contact us immediately, and we will delete the data after verification.

9. Updates to This Privacy Policy

We may revise this Privacy Policy from time to time to reflect business changes, legal developments, or feature updates. For material changes (e.g., new types of data collection or expanded use), we will notify you via an in‑extension notice or a prominent website announcement. The revised policy will show a new effective date at the top. By continuing to use the Premium version after the changes take effect, you indicate your acceptance of the updated terms (if you disagree, please stop using the Premium version and request deletion of your data).

10. Contact Us

If you have any questions, suggestions, or complaints regarding this Privacy Policy or our data processing practices, please contact us using the following methods:

• Email: support@mcdong.com
• Website: www.mcdong.com

We have appointed a Data Protection Officer (DPO). You may reach the privacy team directly by adding “FAO Data Protection Officer” in the email subject line.