Zombie Drive privacy

Updated 27 October 2026

This privacy notice explains how personal data are processed in Zombie Drive for Android and iPhone and for its associated game accounts and shared leaderboards.

1. Controller and contact

For game issues, you can also contact support@lazyshoregames.com. This notice covers Zombie Drive. The website privacy notice also applies to general website visits and messages.

When you contact us, we process the contact details you provide, your message and any information or attachments you choose to send, to handle and answer your request.

2. Starting the game, combined acceptance and withdrawal

Zombie Drive requires combined acceptance of the terms, Firebase gameplay analytics and Firebase crash reporting before you can play. Without this acceptance, play is blocked, including guest play. Signing in with Google or Apple is separate and optional. Opening this privacy notice is not itself consent. Advertising choices are handled separately.

In “Privacy and choices”, you can open the documents and withdraw the combined acceptance. After you confirm withdrawal, the app removes the decision locally, withdraws its analytics and diagnostic authorisation, and requests the SDK-supported disabling of collection and deletion of unsent crash reports. Play ends or is blocked; the startup dialog appears again before you can resume play. This does not delete your local garage, cash, vehicles, armour, records, settings or sign-in account.

Withdrawal concerns subsequent processing. Previously transmitted data do not automatically disappear. Section 7 explains the technical limits of crash reporting. Signing out, withdrawing acceptance and deleting an account are separate actions.

3. Data on your device

Zombie Drive stores vehicle selection and ownership, garage cash, unlocked armour, local records, language, audio and other game settings, and the version and status of your startup decision on your device. It also stores technical states for advertising choices, store connections, purchase entitlements, review requests and update checks.

The garage is not a cloud save. Signing in does not automatically transfer garage cash, vehicles, armour or previous local records to another device or an online leaderboard. Firebase may retain a sign-in session on your device. Operating-system backups may contain local app data and are subject to the settings of that operating system.

4. Internet connectivity and protection of online services

Zombie Drive requires an internet connection, including for guest play. To check whether the installed version may access the game, the app sends its platform and installed build number to our version-check service. Connectivity checks also use addresses provided by Google and, where applicable, Apple. These requests process technical connection information such as your IP address.

Firebase services provided by Google support sign-in, player profiles, leaderboards, result validation and account deletion. Firebase App Check with Google Play Integrity on Android or Apple App Attest on iPhone processes technical evidence of app and device integrity and short-lived verification tokens. These security and operational requests are separate from gameplay analytics and may be necessary without a game account.

The app may contact the relevant store or open its page for updates and review requests. The privacy information of Google Play or Apple also applies. The app does not receive the star rating or review text you submit through the native dialog. It stores locally, in particular, the time and state of a review request.

5. Optional sign-in and player profile

You can play as a guest without a game account. If you choose Google or Apple sign-in, Firebase Authentication processes the account identifiers and authentication data supplied by the provider and, where available, your email address and profile information. Apple may supply a relay email address. Zombie Drive does not require a separate game password. An additional sign-in provider is linked only after your confirmation.

Your public player name is stored separately from the sign-in profile in a private player profile, checked against the naming rules and reserved. Your Google/Apple profile name and email address are not automatically published as your leaderboard name. Freely changing a name after assignment is not a standard feature; you can still make rectification and privacy requests. Your selected country flag is an optional profile choice and does not establish your nationality or actual location.

6. Leaderboards and result validation

Android and iPhone share all-time and weekly leaderboards. For signed-in players with a confirmed public name, the backend processes account and derived player identifiers, player name, optional country, score, distance, platform and result timestamps. Derived identifiers are pseudonymous and do not mean that the data are anonymous.

Leaderboard entries are public. Other people can see your player name, rank, score, distance and optional country flag on the leaderboard. The game interface also uses a derived player identifier. Your email address and original Firebase account ID are not returned as public profile fields. The flag is not derived from your IP address and does not prove nationality or location. Third parties may copy public information.

To validate a ranked run, the server processes a run identifier, account and player association, start, expiry and processing times, vehicle and armour, distance, active driving time and recorded zombie hits. These data support scoring, replay checks and protection against manipulated results. Previous local records and garage cash are not uploaded as leaderboard results. Optional advertising bonuses do not change the score. An automated check may reject a result; you can contact support with questions.

Only confirmed personal bests enter the all-time or current weekly leaderboard. The week resets on Monday at 00:00 UTC and does not automatically delete earlier weeks. Unconfirmed submissions are held temporarily in session memory with time and size limits; signing out, changing accounts, withdrawing startup acceptance or closing the app discards these unconfirmed submissions.

7. Gameplay analytics and crash reports

Firebase Analytics

After the combined acceptance is saved, the app enables Firebase Analytics. The SDK processes automatic app-usage and session events, technical app and device information, and app-instance and installation identifiers. Depending on store and SDK integration, advertising interactions and purchase events may also be recorded. These data help assess usage, stability and opportunities for improvement.

Our game code does not deliberately pass your public player name, email address or Firebase account ID as an Analytics user identifier. Run data submitted for leaderboard validation are a separate process, rather than individual gameplay events configured by us in Analytics. Combined startup acceptance does not enable Analytics advertising storage, advertising user data or advertising personalisation.

Firebase Crashlytics

The combined acceptance also enables Crashlytics reporting. Reports may contain error messages, technical stack traces, app and operating-system versions, device state, installation identifiers and technical information about activity before a fault. They help investigate and fix errors.

Without acceptance, or after withdrawal, the app requests disabling collection and deletion of unsent reports. The native SDK may still cache errors locally. Cached reports may be transmitted after collection is enabled again; some settings take effect on the next start, and transfers already in progress may still finish. More information: Crashlytics data collection.

8. Advertising and separate advertising choices

Zombie Drive uses Google AdMob for occasional full-screen advertisements after a run actually ends and for optional rewarded videos. Completing a bonus video may grant extra garage cash; it does not change your score or distance or continue the run. Remove Ads disables interstitial advertisements while optional bonus videos remain available.

Advertisements are requested only when the status reported by Google's User Messaging Platform (UMP) permits this. Where offered by the service, you can reopen your choice through the in-game advertising privacy options. Combined startup acceptance does not replace the advertising choice, and an advertising choice does not authorise Firebase gameplay analytics.

Google and the advertising partners actually used may process IP address, approximate location derived from it, device and advertising identifiers, app/SDK diagnostic data, and advertisement and video interactions. The advertisements and identifiers used depend on platform, region, system settings and advertising choices. Non-personalised or limited advertisements can also process technical data. Any access to Apple's advertising identifier requiring operating-system authorisation additionally depends on that authorisation. More information: Google advertising technologies.

9. Shop and in-app purchases

The optional one-time Remove Ads purchase is processed through Google Play or the App Store. It removes interstitial advertisements; optional bonus videos remain available. Vehicles and armour are unlocked using earned garage cash and are not sold as additional real-money products.

The integration uses Unity In-App Purchasing and processes product and price information, purchase status, transaction or receipt information, and purchase entitlements to associate the purchase and restore it through the same store account. Depending on the SDK functions used, technical device, installation and session information may also be processed. Payments are handled by the relevant store; our app does not request full credit-card details or operate its own payment server.

Signing into the game does not automatically transfer purchases between Android and iPhone. Deleting the Firebase game account does not automatically delete or refund store purchases. More information: Apple, Google and Unity In-App Purchasing.

10. Purposes and legal bases

We process data for necessary game, account, ranking and purchase operations under Article 6(1)(b) GDPR insofar as processing is needed to provide the service you request. Necessary processing for security, abuse prevention, moderation and general enquiries is based on legitimate interests under Article 6(1)(f) GDPR: reliable game operation, fair rankings and handling enquiries. Legal obligations are fulfilled under Article 6(1)(c) GDPR.

Where processing or access to a device requires consent, valid consent is necessary, in particular under Article 6(1)(a) GDPR and section 25(1) of Germany's TDDDG. The exception in section 25(2) TDDDG applies to storage and access strictly necessary to provide a service expressly requested by you. An interest in improving a game does not replace a requirement for consent.

11. Recipients and processing outside the EEA

Recipients include Google for Firebase, Analytics and AdMob, your selected Google/Apple sign-in provider, Apple or Google for store purchases, the Unity services responsible for the active purchase integration, and SiteGround for support email and website hosting. Providers may use affiliates and subprocessors. Their privacy information also applies to processing for their own purposes.

The game's Firestore database and our Cloud Functions are configured in Frankfurt, Germany. This does not mean all authentication, analytics, crash, advertising, SDK or support data are processed exclusively there. Access and processing outside the European Economic Area, including the United States, are possible. Where required, an appropriate transfer mechanism, such as an applicable adequacy decision or standard contractual clauses, must be used. You can ask our privacy contact for information about the safeguards applicable to your data and copies of them.

Further information: Firebase, Google, Apple, Unity and SiteGround.

12. Retention

We retain personal data only while needed for their purpose or where a legal retention obligation applies. For individual categories:

• Local garage, records and settings: until you reset the app data or the operating system removes them. Device backups may have separate retention cycles.
• Game account, profile, names and leaderboards: generally for the use of your game account and until its associated deletion. A weekly reset does not erase the full history.
• Run records: a run ticket is valid for up to four hours; automatic database deletion is scheduled for 24 hours after its expiry. Technical start limits receive a deletion timestamp after 24 hours.
• Account-deletion jobs: incomplete jobs remain available for safe continuation. On completion, the original account ID is removed from the job. A minimal pseudonymous blocking record remains to prevent old sign-in tokens from recreating the account; no automatic deletion period is configured for this record. It is retained only while needed for this protection or necessary evidence.
• Technical operational and security logs: while needed to investigate faults or abuse or provide necessary security evidence; the cloud services used also apply their own logging and backup cycles.
• Crashlytics and authentication: Google states that crash reports and associated identifiers are retained for 90 days before removal from live and backup systems begins. Google describes a separate cleanup process of up to 180 days for authentication data after account deletion is initiated. See Firebase retention.
• Support: while necessary to handle the request and reasonable follow-up questions. Records subject to statutory retention and evidence needed for legal claims are handled under the applicable requirements.

Deletion timestamps do not guarantee removal at an exact minute. Database cleanup is asynchronous; provider, backup and log data may follow different cycles.

Analytics, advertising and purchase services: user- and event-level Analytics data are deleted under the retention settings of the Analytics property used; renewed user activity may affect the start of the period. Aggregated reporting may follow other rules. Advertising and purchase data are also subject to the processing purposes and statutory retention obligations of each service. More information: Google Analytics data retention.

13. Deleting your game account

You can request account deletion in the game or through our Zombie Drive deletion page. A fresh account check and explicit confirmation are required to identify the account safely. Where an Apple account is linked, revocation of the Apple sign-in authorisation is also handled. The app reports completion only after the server confirms processing; an error or interrupted connection does not confirm completed deletion.

Deletion removes the Firebase game account, profile and name reservation, associated current and historical leaderboard entries, run records and account-related start limits. A minimal pseudonymous deletion guard remains as described in section 12. This does not delete your Google or Apple account with the provider, store purchases, or your local garage, cash, vehicles, armour, records and settings.

Previously transmitted Analytics, Crashlytics, advertising or applicable Unity data are not automatically removed in full by deleting the Firebase account. Contact our privacy address for further requests. We check the association and available deletion methods; an account email address alone does not always identify every SDK identifier. Requests through the website or support follow the identity-verification steps stated there. Do not send passwords, verification codes or sign-in tokens.

14. Your rights

Where the legal requirements are met, you have rights of access, rectification, erasure, restriction and data portability. You can object to processing based on legitimate interests on grounds relating to your particular situation. You may withdraw consent for the future without affecting the lawfulness of processing based on it before withdrawal.

Contact info@lazyshoregames.com. Proportionate identity verification may be necessary to associate the request safely. You can complain to a data protection supervisory authority, including the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia.

15. Minors and changes

Where processing requires a minor player's consent, applicable age and parental-authorisation requirements must be observed. A store age rating does not replace required data protection consent.

We update this notice when processing changes. New or changed purposes requiring consent need corresponding information and a valid choice.