Privacy policy
ZombieHover collects the minimum: no email, no ads, no tracking cookies. Here is what is processed, why, for how long, and your rights (GDPR). The French version (Confidentialité) prevails in case of difference.
Last updated: 5 November 2026.
Controller
Tom Deprez, sole trader, trading name ERUDIT-FRANCE, 511 Les Jardins de Noémie, 38540 Valencin, France. Contact: tom.deprez38540@gmail.com.
Data processed
| Data | Why | Legal basis | Retention |
|---|---|---|---|
| Account | Username; password stored only as a hash (salted scrypt); fingerprint (SHA-256) of session tokens. No email. Used to log you in and keep your account. | Contract | As long as the account exists. Deleted on request. An account inactive for 3 years may be deleted. |
| Progress | Saved games and bases, levels, trophies, tickets, Battle Pass, cosmetics, gameplay statistics. | Contract | With the account. A friends game is deleted after 30 days with no player. |
| Purchases | Premium status and season, Stripe payment session ID, date of your consent to immediate supply and of your waiver of the right of withdrawal. | Contract, legal obligation (proof, accounting) | Up to 10 years (accounting obligations). |
| Security and connection | IP address, date and time, browser (web server logs); IP kept in memory during the connection for security and multi-account detection. | Legitimate interest (service security) | 12 months at most for logs. |
| Anti-cheat | Gameplay measurements computed by the server (speed, movement, walking into walls, invalid messages, kills and wealth per minute, trades and trade partners), suspicion score, verdicts and sanctions. | Legitimate interest (fair play) | 12 months at most; a sanction stays tied to the account while it lasts. |
Anti-cheat and automated analysis
The server automatically analyses every player's gameplay: it corrects impossible movement and, every minute, computes a suspicion score by comparing the statistics of active players.
Every 10 minutes, when at least 4 players are active, a summary of these statistics (username, mode, level, the measurements above, number of other accounts connected from the same IP address, without the IP address itself) is sent to Anthropic (Claude API, United States), which returns a "clean", "suspect" or "cheat" opinion to help judge cheating. This data is never used for advertising.
An automatic suspension is only possible when several safeguards all hold: a "cheat" opinion with at least 90% confidence on two analyses in a row, and a high server-side suspicion score. You can contest any sanction by email and ask for a person to review it (article 22 GDPR); a suspension lifted by the administrator cannot be re-applied automatically.
Recipients and processors
- Hostinger International Ltd. (Cyprus): hosting, server located in France.
- Stripe: payment. Stripe processes your card data and the information asked on its payment page (including the receipt email) under its own privacy policy. We never receive your card data.
- Anthropic (United States): the anti-cheat analysis described above. This transfer outside the European Union is covered by the safeguards provided by the GDPR (European Commission standard contractual clauses).
- Google Fonts: the site's fonts load from Google's servers, which then receive your IP address.
Your data is never sold or used for advertising.
Cookies and local storage
No ads, no audience measurement, no tracking cookies. The game only uses your browser's local storage (localStorage), strictly needed for the service:
zh_tok: login token, to stay logged in;zh_name: your username;zh_opt: your settings;zh_tuto_…: your tutorial progress.
This data stays on your device. Logging out clears the token; you can clear everything from your browser settings.
Minors
You must be at least 13 to create an account. Under 15, the consent of a parent or legal guardian is required.
Your rights
You have the right to access, rectify, erase, object to, restrict and port your data. Write to tom.deprez38540@gmail.com with your username; we may ask you to prove the account is yours (for example from the game). We answer within one month at most.
If you think your rights are not respected, you can complain to the French data protection authority, the CNIL: www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or to the authority of your EU country.