Privacy Policy
This Privacy Policy explains how FLOWZY FZC ("Flowzy", "we", "us") collects, uses and shares personal data when you use the Survival Zomb mobile game for iOS and Android (the "App") and the website survivalzomb.com (together, the "Service"). Flowzy is the data controller for the Service.
Controller: FLOWZY FZC, C1 Building B.C.1301232, Ajman Free Zone, Ajman, United Arab Emirates. Company registration number 33851. E-mail: privacy@survivalzomb.com or support@flowzy.ai.
1. Summary
- The App is free to play. Its ads are rewarded and opt-in (Google AdMob): you choose to watch one for a Second Chance after your horde is swallowed, to double the coins on your results card, or for free coins in the Shop. There are no interstitials and no ad breaks; no ad ever interrupts a life. In the EEA, UK, Switzerland and US states with privacy laws, ads are personalised only with your consent, given in the dialog shown in the App; elsewhere ads may be personalised by default and you can opt out in your device's ad settings (Android: Settings → Google → Ads; iOS: the tracking prompt). You can always play with non-personalised ads.
- The App contains two third-party SDKs that process personal data: the Google Mobile Ads (AdMob) SDK, which serves the rewarded ads, and Meta's app-events SDK (Facebook), which reports a short list of in-app events to Meta so we can measure our install campaigns. Exactly what Meta receives is listed in Section 2, and when it is on or off under "Meta app events" in Section 3. We use no other analytics SDK, and we do not sell personal data.
- Optional in-app purchases — coin packs, the Founder's Pack and the weekly Zomb Pass subscription — are processed by Apple or Google. We never see your card details. One of the Pass perks is "Every ad reward without the ad": with an active Pass the optional ad rewards are granted without watching an ad.
- You can play as a guest without giving us your name or e-mail. A random account ID is created so your progress can be saved in the cloud.
- If you choose to link Google, Apple, Facebook or an e-mail address, we store that identity so you can sign in on another phone.
- Game data (progress, results, friends, league placings, display name) is stored on servers in Frankfurt, Germany (EU), and the realtime islands you play on run on servers in the EU as well.
- You can delete your account and all of its data at any time from Settings → Account, or via survivalzomb.com/delete-account.
2. Data we collect
| Category | Data | Source | Why |
|---|---|---|---|
| Account | Random account ID; friend code (ZOMB-XXXX); display name and colour you choose; creation date and last-seen time | Created by the App / entered by you | Provide the game, cloud save, friends and league (performance of contract) |
| Sign-in identity (optional) | Google account ID and e-mail; Apple user ID and e-mail (or Apple's private relay address); Facebook user ID with the e-mail address and public profile Facebook returns, if you use Facebook Login; or the e-mail address you enter plus a one-time code | You, via Google Sign-In, Sign in with Apple, Facebook Login or e-mail | Let you sign in on another device and recover progress (performance of contract) |
| Game data | Cloud save (level and XP, coins, hero and horde skins you have unlocked, boosts, missions, daily streak, league); the result of each life (biggest horde, placement, hordes swallowed, townsfolk recruited, time survived, coins and XP earned, what ended the life) and weekly league placings | Generated while you play | Provide the game and rankings (performance of contract) |
| Social | Friend requests and friendships, blocked players, referral codes you use, reports | You and other players | Friends and referrals; keeping the game safe (contract; legitimate interest) |
| Device | Push-notification token, platform (iOS/Android), app version, device language | Your device, only if you allow notifications | Send the streak reminder, friend-request notices and game news you opted into (consent, via the OS permission) |
| Advertising (AdMob) | Advertising identifier (Apple IDFA only if you allow tracking in the iOS prompt; Android Advertising ID whenever an ad is requested, unless you have deleted or opted out of it in Android settings), device and app information the ad SDK sends, ad events (loaded, shown, completed, clicked), your IP address (Google may use it to estimate your approximate location, such as your city, to select ads and prevent fraud), SDK diagnostic and performance data (crash logs, app launch time, hang rate, energy use), your consent choices (IAB TC string) | Your device, through the Google Mobile Ads SDK | Show the rewarded ads that keep the game free; measure ad delivery; comply with your consent choices (consent for personalised ads; legitimate interest for non-personalised ads and fraud prevention) |
| Marketing events (Meta) | Your advertising identifier and the device and app identifiers Meta's SDK sends with an event, plus these events and nothing else: a purchase (its value in US dollars, the store product ID and the kind of product), a level reached (the level number), a completed registration (which sign-in method you used), a life played (that it was the arena mode, your placement and whether you finished first) and an invite sent (which app you sent it through). These are per-device events, not aggregated statistics. | Your device, through Meta's app-events SDK, after the consent step described in Section 3 | Measure and optimise the install campaigns we run on Facebook and Instagram (consent where a consent dialog is required; legitimate interest elsewhere) |
| Purchases | Store product ID, purchase token or transaction ID, purchase and renewal dates, subscription status, refund status. Never your payment details. | Apple App Store / Google Play, verified by our server | Deliver what you bought, restore purchases on another device, handle refunds and cancellations (performance of contract) |
| Technical logs | IP address, request timestamps, error messages, device model and app version (also stored with each cloud save to debug save conflicts). When you join an island, our game server logs your IP address, display name, account ID, app version, which island you joined and connection counters, together with the short diagnostic line the App sends (build, caught errors, frame rate). | Automatically by our servers and the App | Security, abuse prevention, debugging (legitimate interest) |
| Support | Your e-mail and the content of messages you send us | You | Answer your request (legitimate interest) |
We do not collect precise location (the ad SDK may infer an approximate, city-level location from your IP address, see Advertising above), contacts, photos, health data or payment card information. The App requests the following device permissions: notifications (optional), vibration, and on iOS the App Tracking Transparency permission (optional; declining means non-personalised ads and keeps your advertising identifier out of Meta's events).
3. How we use data
- Operate the game: save your progress, put you on an island with other players, show your friends and their online status, run the live leaderboard and the weekly league.
- Communicate: send the one-time sign-in code you request by e-mail, push notifications you opted into, and replies to support requests. We do not send marketing e-mails.
- Safety: detect cheating, abuse, spam and violations of our Terms; process blocks and reports.
- Show ads: load and display rewarded ads from Google AdMob (and, where enabled, its mediation partners) when you ask for one, count the ones you watch through so the reward can be granted, and cap the Shop's free-coin ad at three a day. Nothing is shown that you did not choose, and no ad interrupts a life.
- Measure our marketing: send Meta the events listed in Section 2 so we can tell which campaigns bring players who stay.
- Purchases: verify purchases with Apple or Google, grant the items, apply the Zomb Pass and honour refunds and cancellations.
- Improve the game: we look at how lives are played, mostly as aggregated statistics. Some of it is not aggregated — the result of each life is stored against your account so we can show your own history and the league, and the marketing events above reach Meta per device.
Meta app events
Meta's SDK does not start when the App launches. It is initialised only after the ad-consent step has finished, and the App sets its flags from your answer before it does: automatic event logging and advertising-identifier collection are switched on when you have consented to personalised ads, or when no consent dialog is required in your region. In the EEA, the UK and Switzerland this means nothing is sent to Meta unless you opt in, and nothing is sent if you decline personalised ads. Outside those regions the events are on by default. On iOS the advertising identifier is passed to Meta only if you allow tracking in the App Tracking Transparency prompt; if you decline, the App tells Meta's SDK that tracking is not allowed and no advertising identifier is collected. On Android, deleting or resetting your advertising ID in Android settings leaves Meta without a usable identifier. Changing your consent choice takes effect the next time you open the App.
4. Legal bases (EU/EEA/UK users)
Performance of a contract (Art. 6(1)(b) GDPR) for account, game, purchase and social data; consent (Art. 6(1)(a)) for push notifications, which you can withdraw in your device settings, for personalised advertising, which you give or refuse in the consent dialog shown in the App and can change at any time under Settings → Ad privacy choices, and — because they are only sent where that consent has been given — for the Meta app events described in Section 3; legitimate interests (Art. 6(1)(f)) for non-personalised advertising, security, abuse prevention and support; legal obligations (Art. 6(1)(c)) where applicable.
5. Who sees your data
Other players
Your display name, colour, friend code (when you share it), online status, league placings and results are visible to other players in the friends list, on the island's live leaderboard and kill feed, and in the league. Your e-mail address and sign-in identity are never shown to other players.
Service providers (processors)
| Provider | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database, authentication, realtime and hosting of our backend | Frankfurt, Germany (EU); Supabase is headquartered in the USA and acts under Standard Contractual Clauses |
| OVH SAS | Hosting of the realtime game servers that run the islands; the server logs described under Technical logs above are written there | Gravelines, France and Frankfurt, Germany (EU) |
| Resend, Inc. | Delivery of transactional e-mails (sign-in codes) | EU (Ireland) sending region; US company under Standard Contractual Clauses |
| Cloudflare, Inc. | Hosting and protection of survivalzomb.com | Global network |
| Apple Push Notification service / Firebase Cloud Messaging (Google) via Expo | Delivery of push notifications | USA |
| Google LLC / Apple Inc. | Sign-in providers, only if you choose them; they process your sign-in under their own privacy policies | USA |
| Meta Platforms, Inc. | App-events SDK for measuring our install campaigns (Section 3); Facebook Login, only if you choose it; the Facebook share dialog and story sharing, only when you tap them. Meta acts as an independent controller for the data it receives; see Meta's Privacy Policy. | USA; Standard Contractual Clauses |
| Google AdMob (Google LLC) and its mediation partners | Advertising and ad measurement. Google acts as an independent controller for the ads it serves; see how Google uses data from partners. The consent dialog lists every ad partner. | USA |
| Apple App Store / Google Play | Payment processing for in-app purchases and subscriptions | USA / your local store region |
We may also disclose data when required by law, to protect the rights and safety of players, or as part of a merger or acquisition (you will be notified).
6. International transfers
Game data is stored in the EU, and the islands you play on run on servers in the EU. Where a provider processes data outside the EU/EEA or UAE — Google, Meta, Apple and the push services above — we rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.
7. Retention
- Account and game data: until you delete your account. Guest accounts that have not been used for 24 months may be deleted.
- Sign-in codes: one hour. Push tokens: until you sign out or delete your account; once you turn notifications off (in the App or in your phone settings) the token is no longer used, and a token the push service reports as invalid is disabled.
- Purchase records: until you delete your account; Apple and Google keep their own transaction records under their policies. Ad consent choices: stored on your device; ad events at Google and marketing events at Meta follow those companies' own retention.
- Reports and blocks: deleted with your account.
- Server logs: up to 30 days. Support e-mails: up to 24 months.
- League history and results of other players keep an anonymised placeholder after you delete your account.
8. Your rights
Depending on where you live you can access, correct, export, delete or restrict the processing of your personal data, object to processing based on legitimate interests, and withdraw consent at any time. In the App: change your display name in Settings, sign out, or delete your account under Settings → Account. Personalised advertising, and with it the Meta app events described in Section 3, can be refused or withdrawn under Settings → Ad privacy choices where the consent dialog applies, and on iOS in the App Tracking Transparency prompt. For anything else e-mail privacy@survivalzomb.com; we respond within 30 days. EU/EEA users may also complain to their local data-protection authority. California and other US-state residents: personalised advertising and the marketing events we send to Meta can count as "sharing" personal information; you can opt out at any time under Settings → Ad privacy choices, on iOS by declining the tracking prompt, and the App honours the choice you make in the consent dialog. We do not sell personal information.
9. Children
Survival Zomb is not directed to children under 13 (or the minimum age for digital consent in your country, up to 16 in parts of the EU). We do not knowingly collect personal data from children below that age. If you believe a child has created an account, contact us and we will delete it.
10. Security
Data is encrypted in transit (TLS) and at rest. Access to game data is enforced by row-level security rules on the database, so players can only read and change what they are allowed to. No system is perfectly secure; if we learn of a breach affecting you we will notify you as required by law.
11. Changes
We may update this policy. The effective date at the top changes when we do, and material changes are announced in the App. Continued use after a change means you accept the updated policy.
12. Contact
FLOWZY FZC, C1 Building B.C.1301232, Ajman Free Zone, Ajman, United Arab Emirates · privacy@survivalzomb.com · support@flowzy.ai