Privacy Policy: Outbreak Data Protocol

1. Operator, scope and purpose of this policy

Zombival ("Zombival," "we," "us," or "our") operates the browser-based arcade game and website located at zombival.com (the "Service"). This Privacy Policy describes how we collect, use, disclose and retain personal information when you visit the Service, register a survivor name, play the game, view advertising, or contact us at hello@zombival.com.

This policy applies to information processed through the Service. It does not apply to third-party websites, advertising networks, browser extensions, or social platforms that we do not operate, even when linked from the Service. Those third parties have their own privacy notices and you should read them.

If you are accessing the Service from a U.S. state with a comprehensive privacy law (including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Indiana, Tennessee, New Hampshire, New Jersey, Minnesota, Maryland, Rhode Island, Nebraska, and Kentucky), Section 11 of this policy describes the additional rights you may have and how to exercise them.

2. Key definitions

• Personal information / personal data: information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household or device.
• Sensitive personal information: the subset of personal information that includes, depending on the state, government identifiers, precise geolocation, account log-in credentials together with passwords or codes, contents of certain communications, genetic data, biometric data processed to uniquely identify a person, health information, sexual orientation, and similar categories.
• Sale: the disclosure of personal information for monetary or other valuable consideration. Some U.S. state laws use a broad definition that can include the use of advertising cookies even without a direct cash exchange.
• Share / cross-context behavioral advertising / targeted advertising: the disclosure of personal information to a third party for the purpose of cross-context behavioral advertising, regardless of whether monetary consideration is received.
• Service provider / processor / contractor: a third party that processes personal information on our behalf, subject to a written contract restricting use to specified business purposes.
• Deidentified information: information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer.
• Aggregate information: information that relates to a group or category of consumers from which individual identities have been removed.

3. Categories of personal information we collect

In the past twelve (12) months we may have collected the following categories of personal information from the sources and for the purposes described in this policy.

• Identifiers: survivor nickname/name chosen by you, IP address, device identifiers generated by your browser, cookie identifiers, AdSense and Google Analytics identifiers.
• Internet and network activity: referring URL, pages viewed, time on site, interactions with the game canvas (movement, cuts, deaths), buttons clicked, browser language, time zone offset, screen size, operating system, browser type and version.
• Approximate geolocation: coarse location derived from IP address (typically country and region) for analytics and advertising. We do not collect precise GPS coordinates.
• Game data: score, best run, run count, stages completed, clear percentage, time elapsed, lives remaining, gallery unlocks, and similar in-game records.
• Commercial activity: information about advertising interactions such as impressions, ad clicks, and similar measurement events generated by Google AdSense.
• Communications content: email content, subject lines, attachments and metadata when you contact us at our published email address.
• Inferences: derived information drawn from the above, such as preferences for certain stages or game modes, used to balance gameplay and to improve advertising performance through our advertising partner.

We do not knowingly collect Social Security numbers, driver's license numbers, financial account numbers, payment card information, precise geolocation, biometric information, health information, immigration status, religious beliefs, racial or ethnic origin, citizenship, union membership, sexual orientation or sex life, or contents of mail, email or text messages other than email content you voluntarily send to us.

4. Sources of personal information

• Directly from you: the survivor name you enter, any email content you send to hello@zombival.com.
• Automatically from your device and browser: IP address, device and browser characteristics, interaction events, and game state generated by your play session.
• From third-party providers: aggregated or de-identified analytics and advertising performance information from Google Analytics and Google AdSense.
• From hosting and security infrastructure: access logs and error logs generated by the hosting provider, content delivery network, or security tooling.

5. Purposes for which we use personal information

We use personal information for the following purposes, each of which is considered a permissible business purpose under U.S. state privacy laws:

• Operating and maintaining the Service, including authenticating survivor names, storing scores, persisting gallery unlocks, and serving the game canvas.
• Measuring traffic and engagement, identifying which stages or features are popular, and improving gameplay balance.
• Detecting, preventing and responding to fraud, abuse of the score API, denial-of-service attempts, automated scraping, and other security incidents.
• Serving advertising through Google AdSense, including measuring ad performance, capping frequency, attributing conversions, preventing fraud, and where personalized advertising is enabled, selecting ads that may be more relevant to you.
• Responding to your inquiries and providing customer support.
• Complying with applicable law, responding to lawful requests from public authorities, and enforcing our Terms of Use.
• Defending against and pursuing legal claims, conducting investigations, and protecting the rights, safety and property of Zombival, our users and the public.
• Performing internal audits, business planning, and short-term, transient processing such as caching and load balancing.

6. Categories of recipients

We may disclose the categories of personal information listed in Section 3 to the following categories of recipients, each acting either as a service provider, processor, contractor, or independent third party as described:

• Hosting and infrastructure providers that store and deliver site files, run server-side scripts such as the score API, and serve the underlying database file.
• Google LLC ("Google") for analytics: Google Analytics receives measurement events tied to a Google-generated identifier and the technical characteristics of your visit. The measurement identifier in use is G-S1JG2CL1XT.
• Google LLC for advertising: Google AdSense and Google's advertising partners may receive information necessary to serve, measure and personalize ads. The publisher account in use is ca-pub-5070076210009776.
• Security vendors and content delivery networks that filter malicious traffic and cache static assets.
• Professional advisors such as attorneys, auditors and accountants when needed to operate or defend the project.
• Government authorities and law enforcement when required by law, court order, subpoena or similar lawful process, or to protect rights, property or safety.
• Successors in a business transaction such as a merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of assets, or transition of service to another provider. If such a transaction occurs, we will give notice as required by applicable law.

We do not sell survivor nicknames or game records as a standalone commercial product. However, the use of Google Analytics and Google AdSense may constitute a "sale" or "share" of personal information under certain U.S. state laws because of how those laws define those terms. See Section 11 and our Do Not Sell or Share notice for opt-out information.

7. Cookies, local storage and similar technologies

The Service uses cookies, localStorage, sessionStorage and similar browser technologies. For full details, including the names of cookies, retention periods and category-by-category descriptions, see the Cookie Notice. In summary:

• Strictly necessary storage that is required for the Service to function (for example, remembering your current survivor name in localStorage so your run can continue).
• Analytics cookies and identifiers used by Google Analytics to measure traffic and engagement.
• Advertising cookies and identifiers used by Google AdSense and its partners to serve, measure and, where permitted, personalize advertising.

You can control most of these technologies through your browser settings, the consent banner if one is displayed in your region, the Google Ads Settings page at adssettings.google.com, industry opt-out tools at aboutads.info/choices and optout.networkadvertising.org, the AdSense opt-out add-on for browsers, or the Global Privacy Control signal where applicable.

8. Advertising and analytics in detail

Google Analytics. The Service is configured with the Google tag (gtag.js) for Google Analytics 4 using the measurement identifier G-S1JG2CL1XT. Google Analytics processes information about your visit to produce usage reports. We have enabled IP-address handling consistent with Google's documentation for that property. You can install Google's official Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout to prevent your visits from being recorded by Google Analytics, or block analytics cookies through your browser.

Google AdSense. The Service is configured for Google AdSense using publisher account ca-pub-5070076210009776. Google and its advertising partners may use cookies or similar technologies to serve advertising, measure its performance, attribute conversions, cap frequency, prevent ad fraud and, where permitted, personalize the advertising you see. You can review and adjust your ad personalization settings at Google Ads Settings. Additional information about Google's use of cookies in advertising is available at policies.google.com/technologies/ads.

Use of third-party advertising technologies, including Google AdSense, may constitute "sharing" for cross-context behavioral advertising or a "sale" under certain U.S. state privacy laws even when no money is exchanged. See Section 11 and the Do Not Sell or Share notice for details on how to opt out.

10. Sensitive personal information and automated processing

We do not intentionally collect sensitive personal information as defined by California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana or other applicable state privacy laws. If you choose to enter sensitive information as part of your survivor nickname or in an email you send to us, please understand that this is a voluntary choice and we recommend you do not.

The Service does not engage in profiling that produces legal or similarly significant effects about you. Analytics and advertising performance reporting are aggregated forms of automated processing intended to improve the Service and the ads shown, and do not produce decisions of legal or similarly significant effect.

11. Your U.S. state privacy rights

11.1 General rights available in most covered states

Depending on the state in which you reside and whether the operator meets that state's applicability thresholds, you may have one or more of the following rights, subject to verification and to exceptions provided by law:

• Right to know / right of access: to confirm whether we process your personal information and, where applicable, to obtain a copy of the personal information we have collected about you.
• Right to delete: to request deletion of personal information we have collected from you, subject to enumerated exceptions.
• Right to correct: to request correction of inaccurate personal information.
• Right to portability: to receive a copy of certain personal information in a portable, and to the extent technically feasible, readily usable format.
• Right to opt out of sale and sharing / targeted advertising: to direct us to stop selling or sharing your personal information for cross-context behavioral advertising or targeted advertising.
• Right to limit use of sensitive personal information: available specifically in California where we collect sensitive PI; we do not collect sensitive PI by design, but California residents may submit a confirmatory request.
• Right to non-discrimination: we will not deny goods or services, charge different prices, or provide a different level of quality to you because you exercised your privacy rights.
• Right to appeal: in several states (including Virginia, Colorado, Connecticut, Texas, Oregon, Montana and others), if we deny your request you may appeal that decision by replying to our denial with the word "Appeal" in the subject.

11.2 California (CCPA / CPRA)

California residents may exercise the rights described in Section 11.1 under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. In the past twelve (12) months we have collected the categories of personal information listed in Section 3 from the sources listed in Section 4 for the purposes listed in Section 5 and disclosed them to the categories of recipients listed in Section 6. We have not sold personal information for monetary consideration. We may "share" personal information as that term is defined by the CCPA through the operation of Google AdSense and similar advertising technologies, and you may opt out using the methods described in the Do Not Sell or Share notice or by enabling the Global Privacy Control signal in your browser.

You may also designate an authorized agent to exercise rights on your behalf, subject to verification of the agent's authority and your identity.

11.3 Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Montana (MCDPA), Oregon (OCPA), Texas (TDPSA), Utah (UCPA), Iowa (ICDPA), Indiana (INCDPA), Tennessee (TIPA), New Hampshire (NHPA), New Jersey (NJDPA), Delaware (DPDPA), Maryland (MODPA), Minnesota (MCDPA), Rhode Island (RIDTPPA), Nebraska (NDPSA) and Kentucky (KCDPA)

Residents of these states may have access, deletion, correction (where applicable) and portability rights, the right to opt out of targeted advertising, the right to opt out of profiling that produces legal or similarly significant effects (which we do not perform), and the right to opt out of any "sale" of personal information.

In states that provide a right to appeal a denied request, you may appeal by replying to our denial within thirty (30) days. If the appeal is denied, you may have the right to complain to the state attorney general; the relevant office is listed on each state's official website.

11.4 How to submit a privacy request

• Email: send a request to hello@zombival.com with the subject line "Privacy Request" and describe which right you wish to exercise.
• Universal opt-out signal: we recognize the Global Privacy Control (GPC) signal sent by your browser as an opt-out of sale and sharing for cross-context behavioral advertising for the device and browser sending the signal.
• Authorized agents: an authorized agent may submit a request on your behalf with written permission and information sufficient to verify the agent's authority. We may still ask you to verify your identity directly with us.

11.5 Verification

To protect your information we will need to verify your identity before we can act on a request. The information needed depends on the sensitivity of the data, the nature of the request, and the information already associated with you on the Service. Because the Service typically only knows a freely chosen survivor nickname, we may not be able to verify access or deletion requests for data that we cannot reasonably link to you. In that case, we will respond to the request explaining why we cannot fulfill it and any additional information we would need.

11.6 Response timing

We aim to acknowledge most requests within ten (10) business days and complete them within forty-five (45) days, subject to extensions and exceptions allowed by applicable law. If we need more time, we will let you know.

12. Retention

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including providing the Service, fulfilling our legal, accounting and reporting obligations, resolving disputes, enforcing agreements, and preserving leaderboard records during the lifetime of the project.

• Local browser storage remains on your device until you clear it through your browser or through the in-game reset control.
• Server leaderboard records are retained for the duration of the leaderboard. Records may be reset between major game versions if a reset is announced.
• Email correspondence is retained while needed to respond and to keep a record of the inquiry, generally not longer than two (2) years after the last reply unless required by law.
• Hosting and security logs are retained according to the hosting provider's standard policies, typically for a period of weeks to months.
• Analytics and advertising data are retained by the relevant providers under their own retention controls, as described in their privacy policies.

13. Security

We use technical and organizational measures appropriate to the size and nature of the Service, including HTTPS, server-side input validation, file locking when persisting score data, and a unique-name enforcement check that protects survivor identities from accidental overwrites by other players. No online service can guarantee absolute security, and we encourage players to choose survivor nicknames that do not reveal personal information.

If we become aware of a security incident affecting personal information that the law requires us to disclose, we will provide notice consistent with applicable U.S. state breach notification statutes.

14. Do Not Track and Global Privacy Control

"Do Not Track" (DNT) is a legacy browser setting that we do not currently respond to because there is no consistent industry standard for how websites should react. The "Global Privacy Control" (GPC) signal is a more recent universal opt-out mechanism that we honor as an opt-out of the sale or sharing of personal information for the browser and device sending the signal, to the extent required by applicable U.S. state law.

15. Visitors from outside the United States

The Service is operated for a general English-speaking audience and is intended to comply with U.S. privacy law. If you access the Service from outside the United States, your information will be transferred to and processed in the United States or other countries where our hosting providers and advertising and analytics providers operate. These countries may have data protection laws that differ from those of your home country. If you are a resident of the European Economic Area, the United Kingdom, Switzerland or another jurisdiction with data protection laws that require additional disclosures, please contact us for further information.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, including when we add new game features such as server accounts, additional score endpoints, new advertising units, or new analytics. The "Effective and last updated" date at the top of this policy reflects when the most recent changes were made. If we make material changes, we will provide a more prominent notice such as a banner on the Service. Please review this page periodically.

17. Contact

For any privacy question or to submit a request, contact us at hello@zombival.com. For California residents who prefer a postal address, please email us and we will provide the operator postal contact in our response.