Survival ZombPrivacy Policy
This Privacy Policy explains how FLOWZY FZC ("Flowzy", "we", "us") collects, uses and shares personal data when you use the Survival Zomb mobile game for iOS and Android (the "App") and the website survivalzomb.com (together, the "Service"). Flowzy is the data controller for the Service.
Controller: FLOWZY FZC, C1 Building B.C.1301232, Ajman Free Zone, Ajman, United Arab Emirates. Company registration number 33851. E-mail: privacy@survivalzomb.com or support@flowzy.ai.
1. Summary
- The App contains no advertising, no third-party analytics or tracking SDKs, and no in-app purchases. We do not sell personal data.
- You can play as a guest without giving us your name or e-mail. A random account ID is created so your progress can be saved in the cloud.
- If you choose to link Google, Apple or an e-mail address, we store that identity so you can sign in on another phone.
- Game data (progress, runs, friends, league placings, display name) is stored on servers in Frankfurt, Germany (EU).
- You can delete your account and all of its data at any time from Settings → Account, or via survivalzomb.com/delete-account.
2. Data we collect
| Category | Data | Source | Why |
|---|---|---|---|
| Account | Random account ID; friend code (ZOMB-XXXX); display name and colour you choose; creation date and last-seen time | Created by the App / entered by you | Provide the game, cloud save, friends and league (performance of contract) |
| Sign-in identity (optional) | Google account ID and e-mail; Apple user ID and e-mail (or Apple's private relay address); or the e-mail address you enter plus a one-time code | You, via Google Sign-In, Sign in with Apple or e-mail | Let you sign in on another device and recover progress (performance of contract) |
| Game data | Cloud save (levels, currency, upgrades, unlocks, missions, streaks), run results (score, duration, mode, placement), weekly league placings, squad membership | Generated while you play | Provide the game and rankings (performance of contract) |
| Social | Friend requests and friendships, squad invites, blocked players, referral codes you use, reports | You and other players | Friends and squad features; keeping the game safe (contract; legitimate interest) |
| Device | Push-notification token, platform (iOS/Android), app version | Your device, only if you allow notifications | Send friend-request and squad-invite notifications (consent, via the OS permission) |
| Technical logs | IP address, request timestamps, error messages, device type | Automatically by our servers | Security, abuse prevention, debugging (legitimate interest) |
| Support | Your e-mail and the content of messages you send us | You | Answer your request (legitimate interest) |
We do not collect precise location, contacts, photos, health data, advertising identifiers or payment information. The App requests the following device permissions: notifications (optional) and vibration.
3. How we use data
- Operate the game: save progress, show your friends and their online status, compute the weekly league, run squad sessions.
- Communicate: send the one-time sign-in code you request by e-mail, push notifications you opted into, and replies to support requests. We do not send marketing e-mails.
- Safety: detect cheating, abuse, spam and violations of our Terms; process blocks and reports.
- Improve the game using aggregated, non-identifying statistics (for example how many players finish a run mode).
4. Legal bases (EU/EEA/UK users)
Performance of a contract (Art. 6(1)(b) GDPR) for account, game and social data; consent (Art. 6(1)(a)) for push notifications, which you can withdraw in your device settings; legitimate interests (Art. 6(1)(f)) for security, abuse prevention and support; legal obligations (Art. 6(1)(c)) where applicable.
5. Who sees your data
Other players
Your display name, colour, friend code (when you share it), online status, league placings and run results are visible to other players in the friends list, squads and league. Your e-mail address and sign-in identity are never shown to other players.
Service providers (processors)
| Provider | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, authentication, realtime and hosting of our backend | Frankfurt, Germany (EU); Supabase is headquartered in the USA and acts under Standard Contractual Clauses |
| Resend, Inc. | Delivery of transactional e-mails (sign-in codes) | EU (Ireland) sending region; US company under Standard Contractual Clauses |
| Cloudflare, Inc. | Hosting and protection of survivalzomb.com | Global network |
| Apple Push Notification service / Firebase Cloud Messaging (Google) via Expo | Delivery of push notifications | USA |
| Google LLC / Apple Inc. | Sign-in providers, only if you choose them; they process your sign-in under their own privacy policies | USA |
We may also disclose data when required by law, to protect the rights and safety of players, or as part of a merger or acquisition (you will be notified).
6. International transfers
Game data is stored in the EU. Where a provider processes data outside the EU/EEA or UAE, we rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.
7. Retention
- Account and game data: until you delete your account. Guest accounts that have not been used for 24 months may be deleted.
- Sign-in codes: 10 minutes. Push tokens: until you sign out, disable notifications or delete your account.
- Reports and blocks: up to 12 months after account deletion, without your login identity, for abuse prevention.
- Server logs: up to 30 days. Support e-mails: up to 24 months.
- League history and match records of other players keep an anonymised placeholder after you delete your account.
8. Your rights
Depending on where you live you can access, correct, export, delete or restrict the processing of your personal data, object to processing based on legitimate interests, and withdraw consent at any time. In the App: change your display name in Settings, sign out, or delete your account under Settings → Account. For anything else e-mail privacy@survivalzomb.com; we respond within 30 days. EU/EEA users may also complain to their local data-protection authority. California residents: we do not sell or share personal information for cross-context behavioural advertising.
9. Children
Survival Zomb is not directed to children under 13 (or the minimum age for digital consent in your country, up to 16 in parts of the EU). We do not knowingly collect personal data from children below that age. If you believe a child has created an account, contact us and we will delete it.
10. Security
Data is encrypted in transit (TLS) and at rest. Access to game data is enforced by row-level security rules on the database, so players can only read and change what they are allowed to. No system is perfectly secure; if we learn of a breach affecting you we will notify you as required by law.
11. Changes
We may update this policy. The effective date at the top changes when we do, and material changes are announced in the App. Continued use after a change means you accept the updated policy.
12. Contact
FLOWZY FZC, C1 Building B.C.1301232, Ajman Free Zone, Ajman, United Arab Emirates · privacy@survivalzomb.com · support@flowzy.ai