TR
ZomRush.io

Privacy policy

ZomRush.io Privacy Policy

Effective date: November 10, 2026

In short: No ads interrupt gameplay; in the app, a Google AdMob rewarded ad is shown only if you choose one (e.g. "Watch ad, continue"). It uses a random device code and the nickname you choose to save your progress; your nickname is visible to everyone on the leaderboard and online. In the app we use Google Analytics for Firebase, and on iOS Meta's measurement kit, to improve the game and measure our ad campaigns; on iOS the advertising identifier (IDFA) is used only if you allow it. Signing in is optional; if you sign in with Apple or Google, your email address is kept by our sign-in service (Google Firebase) and is not stored on our game server. You can delete your account and data from inside the game or by email.

1. Who we are

ZomRush.io (the iOS and Android apps and the web version at guzelapps.com/zomrush/play) is developed and operated by Sevgi Güzel (Sarıyer, İstanbul, Türkiye). For any privacy question or request: support@guzelapps.com.

2. What we process

2.1 Device code

On first launch the game creates a random device code and stores it on your device. It is not your name, email or a hardware identifier; it is only the key to your progress. The code is sent to the game server over an encrypted connection (HTTPS/WSS). The server does not store the code itself, only a one-way hash (SHA-256). You can see your code under Shelter → Settlement → "Device code".

2.2 Nickname

The nickname you choose when you first open the game (2–16 characters; unique per player) is stored on the server and is visible to other players: on the leaderboard, in the same room, in the list of open rooms, and on the region map of a settlement you founded. Inappropriate names are blocked by a filter; players can report a name on the leaderboard, and when three different players report it, the name is removed and its owner is asked to choose a new one (the server stores the hashed device codes of the reporter and the reported player). Please do not use your real name or other personal information as your nickname.

2.3 Game data

Linked to the hash of your device code, the server stores: character level and experience, player level (permanent XP), Gold balance, unlocked characters and costumes, permanent upgrades and Gold history (how much was earned from which run or night), a summary of single-player runs (duration, kills, waves, bosses defeated; used to calculate Gold and XP), your best run on the leaderboard (weekly and all-time: wave, time, kills, character), settlements (position, buildings, materials, nights survived, invite code) and memberships, and first/last seen times.

2.4 Account (optional)

Signing in is not required. If you use Sign in with Apple or Google, sign-in is handled by Google's Firebase Authentication. Your Firebase account holds what the provider shares: email address (Apple's relay address if you choose "Hide My Email"), your name if the provider shares it, the provider's user ID and sign-in times. Our game server verifies your identity at sign-in but does not store your email address or name; it stores only a hash of your Firebase user ID, the provider type (Apple/Google) and dates. The email of the linked account is kept only on your device, to show it on the account screen.

2.5 In-app purchases (iOS and Android)

Gold packs, a Supporter Pack, characters and costumes can be bought inside the game. Apple or Google Play takes the payment; your card and payment details never reach us or RevenueCat. Our purchase framework, RevenueCat, receives an anonymous user ID (your Firebase user ID if you are signed in) and technical details such as app and OS version, language and store country when the app starts, and the product, date and the store's (Apple or Google Play) transaction ID when you buy. Our game server verifies the purchase with RevenueCat and keeps the product, transaction ID and date with your player record (so Gold is credited once and purchases can be restored). The advertising identifier is not sent to RevenueCat.

2.6 Usage measurement and advertising identifier (app only)

In the iOS and Android apps we use Google's Google Analytics for Firebase: an app-instance ID, sessions, in-game events (run end and wave count, level-ups, choosing a nickname), purchases and device details (model, OS version, language, approximate country from the IP address). We use it to improve the game and to measure how many players our ad campaigns (e.g. Google Ads) bring. On iOS the advertising identifier (IDFA) is used only if you allow it in the "Allow tracking" prompt; you can withdraw this any time under Settings → Privacy & Security → Tracking. On Android you can reset or delete the advertising ID in your device settings. The web version has no measurement.

In the iOS app we collect crash and error reports with Google's Firebase Crashlytics: the technical details of the crash or error, app and system version, device model and the Crashlytics installation ID. Reports do not identify you and are not used for advertising or tracking; they are only for finding and fixing bugs.

Meta ad measurement (iOS app only). To measure how many players our Instagram and Facebook ads bring, we use Meta's Facebook SDK (App Events). It sends Meta that the app was installed and opened, in-app purchases, device details (model, OS version, language, time zone, IP address) and Meta's anonymous ID for this app; the advertising identifier (IDFA) only if you allowed tracking. Without that permission Meta sees results only through Apple's SKAdNetwork, aggregated and without identifying you. The app has no Facebook login or sharing; you do not need a Facebook account and none is linked to the game.

Rewarded ads (Google AdMob, app only). No ads appear during play. If you tap "Watch ad, continue" after dying or "Watch ad, Gold ×2" at the end of a run, Google's AdMob service shows an ad. For this, device and app details (model, OS version, language, IP address), your interaction with the ad (impression, click, watch time) and the advertising ID go to Google: on iOS the IDFA only if you granted tracking permission, on Android the device advertising ID. Without permission Google shows non-personalized ads. In the European Economic Area, the UK and Switzerland, Google's consent form appears before ads. If you don't tap an ad button, no ad is shown. The web version has no ads.

2.7 Notifications

If you allow it, the app schedules local reminders on your device (e.g. "The zombies are waiting!", "Weekly leaderboard resets tomorrow"). They are created on your device; no notification token is sent to our server. You can turn them off in your device settings.

2.8 Technical data

  • IP address: To limit abuse (too many sign-in, room or settlement attempts), the server keeps IP addresses briefly in memory; they are not written to the database. Web server access logging is off for the game server's addresses. Pages of the web version (including this one) appear in the usual web server log (IP address, time, page requested, browser details).
  • Server log: The game server's operational log may contain room codes and player names (joining and leaving rooms). The log has a fixed size and rotates automatically (old entries are deleted).
  • On your device: Settings (sound, haptics, camera, controls, battery saver), your records, chosen character, player name, device code, run summaries waiting to be sent, and linked-account details (provider, email, Firebase ID) are kept in the device's local storage. Deleting the app deletes them.

2.9 What we do not process

We do not ask for location, contacts, photos, camera, microphone, health or payment information. The only ads are the rewarded ads in 2.6 and the only crash reporting is Crashlytics in 2.6. There is no chat or messaging in the game.

3. Why (purposes and legal bases)

  • Providing the game: saving your progress, Gold, upgrades and settlement, running online rooms (performance of a contract; GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)).
  • Optional account: carrying your progress between devices and restoring it on a new phone (contract, started at your request; GDPR Art. 6(1)(b)).
  • Security and abuse prevention: rate limits by IP, limiting fake Gold claims, reporting inappropriate names (legitimate interest; GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
  • Usage measurement: improving the game and measuring our ad campaigns in aggregate (legitimate interest); measuring ad campaigns with the advertising identifier only with your consent (iOS tracking permission; GDPR Art. 6(1)(a); KVKK Art. 5(1)).
  • Rewarded ads: giving the reward for an ad you asked to watch (performance of a contract); personalized ads only with your consent (iOS tracking permission, Google's consent form in the EEA/UK; GDPR Art. 6(1)(a); KVKK Art. 5(1)).

We do not sell your data. The advertising identifier is used only if you allow it, to measure our ad campaigns and for personalized rewarded ads.

4. Who receives data (service providers)

ProviderPurposeData
Google LLC — Firebase Authentication, Google Sign-InOptional sign-inEmail, name (if shared), provider ID, sign-in times, technical connection data
Apple — Sign in with AppleOptional sign-in (iOS only)Name and email Apple asks you to share (email can be hidden)
Google LLC — Google Analytics for FirebaseUsage and ad campaign measurement (app only)App-instance ID, in-game events, purchases, device details, approximate country; on iOS the IDFA with your permission, on Android the advertising ID
Google LLC — Google AdMobRewarded ads (app only, only if you choose)Device and app details, IP address, ad interactions; with permission the advertising ID (iOS IDFA, Android advertising ID)
Google LLC — Firebase CrashlyticsCrash and error reports (iOS app only)Crash/error details, app and system version, device model, Crashlytics installation ID
Meta Platforms Ireland Ltd. — Facebook SDK (App Events)Instagram/Facebook ad campaign measurement (iOS app only)Installs and app opens, in-app purchases, device details, IP address, Meta anonymous ID; with permission the advertising identifier (IDFA)
Cloudflare, Inc.Delivery and security of the website and web gameIP address, browser details, requested page (short-lived technical logs)
RevenueCat, Inc.In-app purchase framework (iOS and Android)Anonymous ID or Firebase ID, purchased product, date and transaction ID, app/OS version, language, store country
Server hostingRented server running the game serverGame data on the server (sections 2.1–2.3)

Google, Meta and RevenueCat may process data on servers outside your country, including the United States, under their standard contractual terms and privacy policies (Firebase, Meta, RevenueCat, Apple). We do not share your data with anyone else unless the law requires it.

5. Retention

  • Game data and the account link on the server are kept until you delete them or ask us to.
  • The server backs up its database before each update; the latest 10 backups are kept and older ones deleted. Deleted data drops out of these backups over time.
  • Your Firebase account stays with Google until you delete your account. Google Analytics data is deleted automatically within 14 months at most. RevenueCat data follows RevenueCat's retention rules; on a deletion request we also delete it there.
  • Data on your device is deleted when you delete the app.

6. Deleting your account and data

If you signed in (inside the game): Main menu (or pause menu) → ACCOUNT → Delete my account → YES, DELETE. To confirm, you sign in once more with the same Apple or Google account. This deletes your character, Gold, upgrades, settlement memberships, device links and account link from the server; a settlement you founded passes to its oldest member, or is deleted if it has no other members. Your Firebase account is then deleted, and if you used Apple, the app's authorization with Apple is revoked. This cannot be undone.

If you played without an account, or cannot open the game (by email): send an email with the subject "data deletion" to support@guzelapps.com. Without an account we can only find your data by its device code: copy it via Shelter → Settlement → Device code → COPY and include it in the email (send the code only to us, never share it with anyone else). We will complete the request within 30 days and reply to you.

Deleting the app removes only the data on your device; for data on the server use one of the options above.

7. Your rights

Under the GDPR (if you are in the EU/EEA), Turkish KVKK Art. 11 and similar laws, you can ask whether we process your data, request access and a copy, correction, deletion, restriction, and object to processing. Send requests to support@guzelapps.com. You can also complain to your local data protection authority.

8. Children

The game contains cartoon zombie violence and is not directed at children under 13. If you believe we hold data from a child under 13, contact us and we will delete it.

9. Security

All connections between the app and the server are encrypted (HTTPS/WSS). The server stores your device code and Firebase ID only as one-way hashes. Your device code is the key to your progress: do not share it.

10. Changes

If we change this policy, we will update this page and its effective date. October 26, 2026: in-app purchases were added (section 2.5) and the game was renamed from ZombieZumbi to ZomRush.io. October 27, 2026: nicknames, leaderboard and name reporting (2.2, 2.3), usage measurement and the advertising identifier with permission (2.6), local notifications (2.7). November 4, 2026: purchases through Google Play in the Android app (2.5). November 5, 2026: this policy and the web game moved to www.guzelapps.com; Cloudflare added for web delivery. November 9, 2026: optional rewarded ads in the app (Google AdMob, 2.6). November 10, 2026: Meta ad measurement in the iOS app (Facebook SDK, 2.6).