Privacy Policy

1. Developer and contact

Cozy Zombie Odyssey is an Android game developed by Lorenzo Gaetano Lollai, the controller responsible for the processing described in this policy. For support, privacy questions or data requests, email lollaideveloper@gmail.com.

2. Game data stored on your device

The game stores progress and settings on your device: currencies, upgrades, weapons, completed runs and eras, unlocked items, rewards, reward cooldowns, and music and sound preferences. It also stores checksums of delivered purchases to avoid crediting the same purchase twice. These records restore progress and apply purchases and rewards consistently.

The update uses Google Play Games authentication and Saved Games to back up progress with Google. It associates a Play Games player ID with saved progress, currencies, upgrades, reward records and purchase checksums. It retrieves these records on another device using the same Play Games account. No developer-operated cloud-save server is used, and no Google account password or OAuth client secret is stored in the game. Sound and vibration preferences stay on the device. The game does not request your name or email to play, or access GPS, contacts, camera or microphone. Device and operating-system backups depend on your own device settings.

The Play Games SDK also processes service analytics and diagnostic information for stability and product improvements, as explained in Google's Play Games data disclosure. The game does not request your friends list or upload gameplay screenshots. Google handles Play Games authentication and storage under its Privacy Policy. The game reads an existing save before uploading local progress, and does not automatically combine saves from different Play Games accounts. Offline progress stays on the device until a later successful sync.

3. Support correspondence

If you contact the developer, your email address, message and any attachments you choose to provide are used to answer and resolve your request. Please send only information relevant to the problem. The support mailbox uses Gmail; Google processes delivery and storage under its Privacy Policy. Contacting support does not subscribe you to marketing.

4. Optional Google AdMob advertisements

Advertising-enabled versions offer optional rewarded advertisements through Google AdMob and its Google Play services components. The game describes the reward before you choose to watch. Videos are shown only after you select an offer; starting or retrying a game does not require watching a video.

Version 0.60.8 is configured to request advertisements through the game's own AdMob units. Ad availability depends on Google, your privacy choices and applicable restrictions. Earlier test previews, including version 0.50.0, use Google's sample advertisements. Test advertisements do not generate advertising revenue, but privacy checks, SDK initialisation and ad requests can still involve data processing. See Google's explanation of test advertisements.

When the advertising SDK requests or displays an ad, Google may process the following:

• An IP address, which may be used to estimate an approximate location.
• App and advertisement interactions, such as launches, taps and video views.
• Technical information about device and app performance.
• Identifiers such as the Android advertising ID, app set ID and, where applicable, identifiers associated with signed-in accounts on the device.

This processing supports advertising, measurement and fraud prevention. It can occur when an ad is requested or loaded, even if you do not finish watching a video. These data can identify a device or relate to an individual; they are not necessarily anonymous. Google's SDK transmits user data using TLS. See Google's advertising SDK data disclosure and how Google uses information from partner apps.

5. Advertising choices

At launch, Google's UMP SDK checks whether a privacy message is required. The game presents the required Google consent form before requesting advertisements. Privacy requests themselves may communicate with Google. Where Google requires a privacy options entry point, open the game's Settings and choose PRIVACY CHOICES to review or change your choices. The game uses the SDK's current consent status to determine whether advertisements may be requested. See Google's UMP information.

Choosing to watch a rewarded video is separate from consenting to personalised advertising or access to device identifiers. Your privacy choices are stored by the Google SDK; local game records separately track rewards and cooldowns.

You can decline or withdraw consent where consent is requested. Withdrawal does not affect processing lawfully carried out beforehand. Playing the game does not require agreeing to personalised advertising. The availability and type of rewarded advertisements may depend on your choices, age-related restrictions and applicable requirements. Non-personalised ads may still process data and require consent for certain purposes.

Android's privacy settings also provide controls for the advertising ID. Changing those settings does not automatically delete data already held by providers. See Google's advertising and device controls.

6. Google Play purchases

The game supports optional one-time purchases of coin and gem packs through Google Play Billing. Google Play presents the price and payment confirmation. Google processes the payment using your Google account and payment method. The game does not receive your full card number, bank account details or Google account password through the billing integration. Google's processing is described in its Privacy Policy and Google Payments Privacy Notice.

The game receives purchase information from Google Play, including the product, purchase status, quantity, signed purchase data and a purchase token. It uses this information to verify a purchase, credit the purchased currency, recover purchases whose delivery has not finished and confirm delivery to Google Play. Purchase tokens and signed receipt data are processed in memory; the game saves currency and purchase checksums on the device to prevent duplicate delivery. The game does not send these records to a developer-operated server.

Google may also make order and sales information available to the developer through Play Console or payment reports. Depending on the record, this can include an order identifier, product, amount, purchase or refund status, and regional or tax information. The developer uses available transaction records for purchase support, refunds, accounting, fraud prevention and applicable legal obligations. If you contact support about a purchase, you may provide an order identifier to help locate it. Please do not send card details or your account password.

Purchased coins and gems are consumable items recorded in the game save. The latest save successfully synchronised with Google Play Games can restore the remaining balance and purchase checksums on another device. Google Play order history alone cannot recreate balances already delivered and spent. Unsynchronised changes and older purchases without a surviving save cannot be recovered automatically. If two devices have conflicting progress, the player chooses one complete save; balances and separate purchases are not added together. Local recovery copies retain the alternatives on the device where the conflict was resolved. Deleting local data does not delete Google's order history, cancel an order or request a refund. For a purchase problem, contact the developer or use Google Play's refund support.

7. Usage statistics and diagnostics

Starting with version 0.60.8, the game uses Google Analytics for Firebase to measure use of the game and improve its operation. The SDK can collect app-instance identifiers, app and device characteristics, an approximate location derived from IP information, first opens, sessions, screen or app lifecycle events, and purchase events such as product and price when applicable. Depending on the installed version, gameplay events for Runner and Patient Zero can include starts, results, retries or resumed visits, active play duration, progress checkpoints, route and boss encounters, health and weapon tier, coins, zombie defeats, dodges, bowling hits and upgrade choices, or the level, replay status, day, infections, recruits, companion losses, alarms and captured sites. These events do not contain your name, email address, support messages, purchase tokens, saved-game files or movement coordinates. The game does not set a Firebase Analytics user ID or associate analytics events with your Play Games player ID. Firebase Analytics advertising-ID collection is disabled in the app; the separate AdMob SDK has its own processing as described above. See Google's Analytics SDK data disclosure.

The game uses Google's UMP Consent Mode integration through the existing privacy message. Consent signals start denied. Where the European privacy message applies, UMP interprets the player's choices. Starting with version 0.60.17, after a successful current UMP update explicitly confirms that European consent is not required and the native regional signal confirms this, the game may enable Analytics storage for usage statistics if there are no existing European choices or other regional privacy signals. This regional default does not grant advertising storage, advertising user-data sharing or ad personalisation, and Firebase advertising-ID collection remains disabled. Errors and unknown regional signals do not grant this default. Advanced Consent Mode can send limited measurement signals without an app-instance identifier when Analytics storage is denied. You can review choices exposed by UMP through the existing Advertising privacy entry in Settings where required. See Google's UMP Consent Mode documentation.

The game is built with Unity. Unity Engine Diagnostics remains disabled, as in advertising-enabled previews starting with version 0.50.0. Unity Analytics, Unity Ads and Firebase Crashlytics are not used. Diagnostic information processed by Google's advertising and Play Games SDKs is separate from Firebase Analytics.

Earlier preview builds were made with Unity Engine Diagnostics enabled and could have sent installation identifiers and technical diagnostic records to Unity to investigate errors and stability. Disabling the setting does not modify an APK already installed or erase previously transmitted records. Actual collection from those previews has not been confirmed.

For this service, Unity acts as the developer's processor and documents a default retention of 90 days. If you have a concern about an earlier preview, email the developer with the app version and relevant details. Requests concerning provider-held records may require an installation identifier and assistance from Unity. See Unity Diagnostics privacy information and Unity's policy for game players.

8. Purposes and legal bases

Where the GDPR applies, local game records, account-linked cloud backup and restoration, and purchase processing are used to provide the game functions and purchased content you request (Article 6(1)(b), where personal data are involved). Support correspondence and necessary transaction checks are processed for the legitimate interest in responding to requests, resolving problems and preventing duplicate delivery or fraud (Article 6(1)(f)). Records needed for accounting or statutory requests are processed to comply with applicable legal obligations (Article 6(1)(c)). Earlier preview diagnostics, if collected, serve the legitimate interest in investigating game errors and stability (Article 6(1)(f)).

In advertising-enabled versions, consent is the basis for advertising processing that requires it (Article 6(1)(a)), including personalised advertising and device access where applicable. Necessary advertising security and fraud-prevention processing may rely on legitimate interests or legal obligations where permitted. Google explains its own purposes and legal bases in its privacy information. Analytics processing that requires consent uses that consent (Article 6(1)(a)); limited measurement without analytics storage and necessary service security rely on legitimate interests where permitted (Article 6(1)(f)), subject to applicable requirements. Merely continuing to play does not provide consent.

Meta App Events: advertising measurement from version 0.60.17

Version 0.60.17 includes Meta's Android App Events SDK to measure app installations and app activations attributable to advertising campaigns on Facebook and Instagram. The SDK runs only after the existing Google UMP privacy form provides a current valid choice covering Meta and the relevant device-storage and advertising-measurement purposes. You can decline Meta in that form and review or withdraw your choice through the existing Advertising privacy entry in Settings. Refusing does not prevent playing. No additional Meta login or separate consent button is added.

For this integration, Meta's automatic startup and automatic app-event logging are disabled. The game explicitly reports installation/activation after the applicable choice. It does not send custom gameplay events, Play Games player IDs, cloud saves, email addresses, names or purchase events to Meta. When enabled, the SDK can process an app-scoped identifier, an advertising identifier where available and permitted by the device, install-referrer and attribution information, app activation timestamps and device/network information such as operating system, device model, language and IP address. Meta may derive approximate location from network information and match signals with advertising activity. The developer receives campaign reports; aggregated reports do not mean all underlying signals are anonymous.

The current implementation does not start Meta from the Google Analytics regional default or the ability to request an AdMob advertisement. It requires the supported European UMP vendor/purpose choice. When such signals are missing, rejected, revoked, unknown or not supported for another region, it does not send new explicit Meta installation/activation events. Consequently this integration does not count every download or player, including unsupported non-European consent cases. Revocation stops new explicit app events and advertising-ID collection; it does not retract completed requests or automatically delete data already received by Meta. Requests already in flight may finish.

Where consent is required, it is the basis for device access and campaign measurement. Meta's terms govern its own use of the information, which can include matching and advertising measurement; information may be processed in other countries, including the United States, under the applicable provider terms and transfer safeguards. See Meta's Privacy Policy, Meta Business Tools Terms and Meta's privacy controls. Provider retention and deletion follow those terms, your applicable choices and legal requirements; this game does not promise a fixed automatic deletion period for Meta's independently held records.

Deleting local game progress does not erase Meta's server records or reset the SDK's installation record. Android's clear-app-storage control removes local app data, including local SDK preferences. For a request about records controlled by the developer, use the privacy contact above; for Meta's independently controlled records, use Meta's privacy controls and request procedures.

9. Providers and international processing

The relevant providers are Google for support email, advertisements, advertising privacy choices, Google Play payments, Play Games authentication and cloud saves, Google Analytics for Firebase and Firebase Hosting, Meta for the App Events campaign-measurement integration described above, and Unity for any earlier diagnostic records. Google generally acts as an independent controller for AdMob. For European advertising data, Google's controller terms identify Google Ireland Limited as the relevant end controller. Google and its advertising partners may receive data in accordance with the applicable choices and provider disclosures. Google's payment processing and relevant Google entities are described in the Google Payments Privacy Notice linked in section 6. See Google's service roles and controller terms.

Providers may process information outside your country, including in the United States. Google's terms describe the Data Privacy Framework for applicable transfers to certified US entities and contractual safeguards where relevant. Unity's diagnostic arrangements are described in its Data Processing Addendum. The linked documents explain provider-specific safeguards and how to request further information.

10. Retention and deletion

Game records remain on your device until removed. To reset them, open Android Settings, select Cozy Zombie Odyssey under Apps, then clear the app's storage/data. This removes local progress, preferences and the game's local backup files. Device backup copies follow your operating-system settings.

In version 0.60.8, open Settings → DELETE DATA → DELETE LOCAL DATA, then confirm to reset the game. You can cancel before deletion. This resets progress, coins, gems, upgrades, sound settings and purchase checksums on the current device and removes the game's local save backups. Changes that were not synchronised are lost. This control also deletes local conflict recovery copies and pauses automatic cloud sync. It does not delete the Google Play Games save. Reconnecting using CLOUD SAVE can restore that Google save. The control is unavailable while a game, video or unresolved purchase is in progress. It does not erase advertising or payment records held by Google, change Google privacy choices, request a refund, or remove operating-system backup copies.

Support messages are retained only as long as needed to resolve the request, handle necessary follow-up and meet applicable legal obligations or establish, exercise or defend legal claims. Uninstalling the game does not delete support messages or records previously sent to a provider.

Purchase checksums remain in the local save until it is removed and, when synchronised, in the Google Play Games save until that game data is deleted through Google. Local recovery copies are removed by DELETE LOCAL DATA. The developer retains any copies of transaction records for support or accounting only as long as necessary for those purposes and applicable legal obligations or claims. Google independently retains payment and order records, including records made available through Play Console, under its own policies and legal obligations; clearing the game save does not remove them.

Firebase Analytics retention follows the Analytics property's configured retention period and Google's applicable processing terms. Deleting local game data also resets Analytics data held on the device and the app-instance identifier, without changing the UMP privacy choices. It does not automatically delete events already sent to Google. For a request concerning analytics records controlled by the developer, contact the privacy email above; the developer may need information that identifies the relevant app instance and will use the available Google Analytics deletion tools where applicable. Do not send account passwords or payment details. See Analytics data retention and Firebase privacy and security information.

Google's retention depends on the type of data, its purpose and applicable settings; see Google's retention information. Unity's documented diagnostic default is described above. Provider retention is not controlled by clearing the game's local storage.

11. Your rights

Depending on the applicable law and circumstances, you may request access, correction, deletion, restriction or portability of personal data, object to processing based on legitimate interests, or withdraw consent. For personal data held by the developer, such as support correspondence or transaction records, contact lollaideveloper@gmail.com. The developer may ask for information reasonably needed to identify the relevant records and verify the request. There is no developer-operated cloud-save database. To remove the Google Play Games save, use Google Play Games settings to delete data for Cozy Zombie Odyssey; see Google's game-data deletion instructions. The developer cannot remotely erase gameplay saves on your phone or independently controlled Google advertising or payment records. Deletion requests may be limited by applicable record-retention obligations.

GDPR requests normally receive a response within one month; extensions for complex requests follow the applicable notice requirements. You may complain to your local supervisory authority, including Italy's Garante per la protezione dei dati personali. See the Garante's explanation of your rights.

Requests about data controlled independently by Google can also be made through the contact and privacy controls in their linked policies.

12. Young players

Cozy Zombie Odyssey is intended for teenagers and adults aged 13 and over, corresponding to Google Play's 13–15, 16–17 and 18-and-over target groups. The game is not directed to children under 13. Target-audience age groups are separate from the content ratings assigned in individual countries. Availability for a particular player remains subject to those ratings, applicable local requirements and parental or store controls.

Current controls. Version 0.60.8 does not ask for or store a player's age or date of birth. It uses the standard UMP consent flow and a maximum ad content rating of T. It does not apply age-specific child or teen advertising treatment. An ad content rating is not proof of a player's age or ability to consent, and Google's advertising consent form is not an age verification system. Advertising data processing is described in sections 4 and 5; changing the target audience in Play Console does not change an installed build's behaviour.

The intended audience does not mean that all players are adults or can independently consent in every country. The controls described here do not establish that parental authorisation has been obtained. This policy will be updated before changes to the game's age-related controls or data processing take effect. See Google Play's target-audience guidance and Google's age-related advertising settings.

Requirements for independent consent and parental authorisation vary by country. Where applicable law requires parental authorisation for personal-data processing, that authorisation must be obtained before the processing. Version 0.60.8 does not implement an in-game parental-consent mechanism. Choosing to watch a rewarded video or selecting a target-audience age group does not provide parental authorisation. Google Play purchases are also subject to Google's account, payment and parental-control requirements.

If you are a parent or guardian and have questions about your child's data, or want to request access, correction or deletion of personal data held by the developer, contact lollaideveloper@gmail.com. The developer may request information reasonably necessary to identify the relevant records and verify your authority to make the request. Local game records and independently controlled provider records can also be managed as described in sections 10 and 11.

13. This policy website

This page is published through Google Firebase Hosting. Hosting processes IP addresses of incoming requests to detect abuse and analyse service usage, retaining IP data for a few months as described in Firebase privacy and security information. The developer has not added advertisements, analytics scripts, external fonts or contact forms to this page.

14. Security and changes

The developer takes reasonable steps to protect information handled for support. The protection of local records also depends on your device and its security settings. No storage or transmission method can guarantee complete security.

This policy will be updated when the game's data practices change. The date above identifies the latest revision. Material changes will be communicated and new consent requested where required.