Zombival

Privacy Opt-Out File

Do Not Sell or Share My Personal Information

Effective and last updated: May 21, 2026. This notice describes how residents of U.S. states with comprehensive privacy laws can opt out of the sale or sharing of personal information, the use of personal information for targeted advertising, and certain other uses.

1. Summary and current status

Zombival does not sell survivor nicknames, gameplay records or gallery unlocks as a standalone product for money. However, the Service uses Google AdSense and Google Analytics. Under several U.S. state privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the use of advertising technologies that pass identifiers to third parties may be considered a "sale," "sharing," or "processing for targeted advertising" even when no money is exchanged.

This notice gives you a clear way to opt out of those activities.

2. Key definitions used in this notice

  • Sell / sale (California): selling, renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating a consumer's personal information by the business to a third party for monetary or other valuable consideration.
  • Share / sharing (California): renting, releasing, disclosing, disseminating, making available, transferring or otherwise communicating a consumer's personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration.
  • Targeted advertising (Virginia, Colorado, Connecticut, Texas, Oregon, Montana and others): displaying advertisements to a consumer where the advertisement is selected based on personal data obtained or inferred from that consumer's activities over time and across non-affiliated websites or online applications to predict the consumer's preferences or interests.
  • Cross-context behavioral advertising: the targeting of advertising based on a consumer's personal information obtained from their activity across distinctly-branded websites, applications or services, other than the website, application or service with which the consumer intentionally interacts.
  • Authorized agent: any natural person, or a business entity registered with a state, that a consumer has authorized to act on their behalf in submitting a privacy request.

3. What categories of personal information may be shared for advertising

Through the use of Google AdSense and similar advertising technologies, the following categories of personal information may be disclosed to Google and Google's advertising partners and may constitute "sharing" or "targeted advertising" under U.S. state privacy laws:

  • Identifiers such as cookie identifiers, AdSense identifiers and IP address.
  • Internet and network activity such as pages viewed on the Service, time spent and interaction events.
  • Approximate location derived from IP address.
  • Device and browser characteristics such as operating system, browser version, language and screen size.
  • Inferences drawn from the above for advertising relevance.

Through the use of Google Analytics, similar categories of information are disclosed to Google for analytics measurement, which is treated as a "service provider" or "processor" relationship in most jurisdictions but may, depending on configuration, be considered a "sale" or "sharing" under California's broad definitions.

4. Your right to opt out

If you are a resident of a U.S. state with a comprehensive privacy law, you have the right to opt out of:

  • The "sale" of your personal information (California).
  • The "sharing" of your personal information for cross-context behavioral advertising (California).
  • The processing of your personal information for "targeted advertising" (Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Indiana, Tennessee, New Hampshire, New Jersey, Minnesota, Maryland, Rhode Island, Nebraska, Kentucky and other states with similar laws).
  • The processing of your personal information for profiling in furtherance of decisions that produce legal or similarly significant effects (we do not perform such profiling, but you may submit a confirmatory request).

You do not need to verify your identity to exercise the right to opt out of sale, sharing or targeted advertising. We may, however, ask for limited information to apply your opt-out to the correct browser, device or server-side record.

5. How to opt out

You may opt out through any of the following methods. We treat all of them as valid opt-out requests:

  • Email opt-out request. Send an email to hello@zombival.com with the subject line "Do Not Sell or Share Request." We will apply your opt-out and respond as required by law.
  • Global Privacy Control (GPC). If your browser sends the GPC signal, we will treat it as a valid opt-out of sale and sharing for that browser and device. You can enable GPC through compatible browsers or extensions; see globalprivacycontrol.org for instructions.
  • Google Ads Settings. Use Google Ads Settings to turn off ad personalization on Google services.
  • Industry opt-out tools. Use Digital Advertising Alliance opt-out and Network Advertising Initiative opt-out to manage interest-based advertising across participating companies.

Send opt-out request

6. Authorized agents

You may use an authorized agent to submit an opt-out request on your behalf. The agent should clearly identify themselves as an authorized agent, identify the consumer on whose behalf the request is being made (to the extent possible given that the Service only knows survivor nicknames), and provide written permission. We may take reasonable steps to verify the agent's authority and the consumer's identity in line with state law.

7. Right to limit the use of sensitive personal information

California residents have the right to limit the use of sensitive personal information collected about them to specific business purposes. By design, the Service does not collect sensitive personal information for purposes that would trigger this right. If you believe sensitive personal information about you is being processed beyond the permitted purposes, contact hello@zombival.com with the subject "Limit Sensitive PI Request."

8. Children and minors

Under California law, the personal information of consumers under the age of 16 may not be sold or shared without affirmative authorization (opt-in). Consumers between 13 and 15 may give that consent themselves; consent for a child under 13 must be given by the child's parent or guardian. We do not knowingly sell or share the personal information of any consumer under 16. If you believe that a minor's personal information has been sold or shared without proper authorization, contact us at hello@zombival.com.

9. State-specific opt-out details

9.1 California (CCPA / CPRA)

Right to opt out of sale and sharing applies. We honor verified email requests and the Global Privacy Control signal. There is no fee for exercising this right, and we will not discriminate against you for doing so.

9.2 Virginia (VCDPA)

Right to opt out of targeted advertising, sale and certain profiling. Right to appeal a denied request by replying "Appeal" within thirty (30) days.

9.3 Colorado (CPA)

Right to opt out of targeted advertising, sale and certain profiling, including via a recognized universal opt-out mechanism. We honor Global Privacy Control as such a mechanism.

9.4 Connecticut (CTDPA)

Right to opt out of targeted advertising, sale and certain profiling, including via universal opt-out mechanism. We honor Global Privacy Control.

9.5 Utah (UCPA)

Right to opt out of targeted advertising and certain sales. Appeals process is not provided by statute.

9.6 Texas (TDPSA)

Right to opt out of targeted advertising, sale and certain profiling. Universal opt-out mechanism support is being phased in by state regulation; we honor Global Privacy Control as the universal mechanism in use today.

9.7 Oregon (OCPA)

Right to opt out of targeted advertising, sale and certain profiling, including by universal opt-out mechanism.

9.8 Montana (MCDPA), Delaware (DPDPA), Iowa (ICDPA), Indiana (INCDPA), Tennessee (TIPA), New Hampshire (NHPA), New Jersey (NJDPA), Maryland (MODPA), Minnesota (MCDPA), Rhode Island (RIDTPPA), Nebraska (NDPSA), Kentucky (KCDPA)

Residents of these states have similar rights to opt out of targeted advertising, sale and, in most states, certain profiling. Specific request processes, appeal windows and universal opt-out recognition vary by state. Contact us to exercise any of these rights and we will apply the framework that gives you the most protection.

10. Verification

Opt-out requests do not require identity verification. For requests for access, deletion or correction we may need to verify your identity to protect your information against unauthorized disclosure. Because the Service typically only knows a freely chosen survivor nickname, we may be unable to verify some requests. In that case we will respond explaining why and what additional information would be needed.

11. Response timing

We aim to acknowledge opt-out requests promptly and to action them within fifteen (15) business days for sale and sharing under California law, and within the time periods provided by other applicable state laws (typically forty-five (45) days for access, deletion and correction). If a request requires more time, we will let you know and explain the reason.

12. Non-discrimination

We will not deny you the Service, charge you a different price, or provide you a different level of service because you exercised a privacy right. This includes the right to opt out of sale, sharing or targeted advertising.

13. Changes to this notice

We may update this notice when new state laws take effect, when we add or remove advertising or analytics technologies, or when the Service's data practices change. The "Effective and last updated" date at the top reflects the latest revision.

14. Contact

For any opt-out or privacy question, contact hello@zombival.com.