Privacy Policy

The short version

Zombie Arcade is a free browser-based collection of five HTML5 games. We don't sell your data. We collect the minimum needed to let you sign in, save your progress across devices, buy a VIP pass if you want one, and keep the leaderboards honest. If you want everything deleted, email us at hello@zombiecollector3d.com and we'll wipe your account within 7 days.

1. Who we are

"Zombie Arcade" (the "Site", "we", "us") operates the website zombiecollector3d.com and its subdomains. This Privacy Policy applies to every game hosted on the Site, including Zombie Collector 3D, Zombie Solitaire, Zombie Crush, Zombie Merge, and Zombie Idle Tycoon. Contact us any time at hello@zombiecollector3d.com.

2. Information we collect

2.1 When you play as a guest

You can play every game without signing in. In that case we store your progress in your own browser using localStorage (e.g. your best Solitaire time, your Zombie Idle Tycoon save, your Crush high score). We do not upload that data to any server. Clearing your browser data will erase this progress.

2.2 When you sign in with Google

If you choose to sign in with Google, we receive from Google only the information needed to identify your account: your Google account email address, your display name, your profile picture URL, and a stable account identifier. We never receive your Google password.

2.3 When you play while signed in

We store gameplay progress on our servers so it follows you across devices. This includes your player level, XP, coins, gems, cosmetics owned, VIP status, achievements, run stats, and the results of finished games (score, level, moves used, elapsed time, and whether you won).

2.4 When you make a purchase

VIP passes and coin packs are processed by Stripe. We never see or store your full credit card number. Stripe returns to us only a session identifier and success/failure status. See Stripe's Privacy Policy for how they handle payment data.

2.5 Automatically collected

When you visit any page we may automatically log your IP address, browser type and version, referring URL, and pages visited — this is standard web-server behaviour and is used for security, abuse prevention, and aggregate analytics (e.g. "how many people played Solitaire this week"). We do not build advertising profiles from this data.

3. How we use your information

• To let you sign in and stay signed in across sessions.
• To sync your game progress across devices.
• To display your username and level on leaderboards.
• To grant your VIP / Founder perks after a successful purchase.
• To prevent abuse (rate-limits, fraud detection on rewards).
• To reply to your emails when you contact support.
• To send critical service emails (e.g. VIP receipt). We do not send marketing emails.

4. Cookies and local storage

Zombie Arcade uses first-party cookies to keep you signed in (a JWT session token) and localStorage to save game state client-side (Tycoon save, Crush high score, Solitaire streak, etc.). We do not use third-party advertising cookies. If we enable ads in the future via Google's H5 Games Ads product (which we have been approved for but not yet enabled), Google may set additional cookies subject to Google's Cookies Policy, and we will update this Privacy Policy before turning ads on.

5. Third-party services we use

• Google (Sign-In with Google) — used only for authentication. Google Privacy Policy
• Stripe — used only for payment processing. Stripe Privacy Policy
• MongoDB Atlas — hosts our player database in the United States.

6. Your rights

No matter where you live, you can email us at hello@zombiecollector3d.com to:

• Ask what data we hold on you (data-access request).
• Correct anything that's wrong.
• Delete your account and all associated data (data-erasure request).
• Export a copy of your data in JSON format.
• Withdraw consent to future marketing (we don't send any today).

We'll respond within 7 days. Residents of California, the EEA, and the UK have additional rights under the CCPA, GDPR, and UK GDPR respectively — those laws apply to us and we honour those requests on the same 7-day timeline.

7. Children

Zombie Arcade is designed for a general audience and is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at hello@zombiecollector3d.com and we will delete the account promptly.

8. Data retention and security

We keep your account data as long as your account is active. Deleted accounts are purged within 30 days. Payment records required for tax purposes are kept for 7 years per US federal record-keeping requirements. All data is transmitted over HTTPS; passwords for internal admin accounts are hashed with bcrypt; JWT tokens use HTTP-only cookies with the secure and SameSite=Lax flags.

9. Changes to this policy

If we make material changes to this policy, we'll update the "Last updated" date at the top and, if you have an account, we'll show you a notice the next time you sign in. Continued use after a change means you accept the new policy.

10. Contact

Questions, requests, complaints, or love-letters: hello@zombiecollector3d.com