Privacy Policy
Night of the Zomfoids · zomfoids.com · Last updated: 9 November 2026
Night of the Zomfoids ("the game") is a browser game run by Prince Ray Peratta Espinoza, Rua Manuel Teixeira Gomes 24, 1950-188 Lisboa, Portugal ("we"), who is responsible for the data described here. You can reach us at proice526@gmail.com. This policy explains what information the game uses, why, and for how long. You can look around as a guest without an account; in that case your progress stays only in your browser (local storage) and we keep nothing about you on our servers. Like any website, our hosting provider (Cloudflare) processes your IP address to deliver the pages and protect them from attacks.
Signing in
Signing in is needed to buy the full game and to appear in the daily ranking.
If you sign in with Google or X, we receive from that provider only your account identifier, your display name and your profile picture (from X also your @username). We use this only to create your game account, show your nickname in the daily ranking, and keep your progress and purchases in sync across your devices. We never post anything on your behalf and we never receive your password. The daily ranking is public: anyone can see the nicknames and scores on it, and its data also includes the link to each player's profile picture.
If you sign in with a crypto wallet, you sign a sign-in message in your wallet; this is free and sends no transaction. We store your public wallet address as your account identifier (a shortened form of it is your first nickname). We never receive your private keys or seed phrase.
To show you the right buttons, the Account and purchase screens check which crypto wallet extensions are installed in your browser (for example MetaMask or Phantom). This check happens only on your device: the game does not store the result and does not send it to us or to anyone else.
Payments
Card, Apple Pay and Google Pay purchases are sold through Link, Stripe's checkout and payment service, which is the merchant of record for them. Link (Stripe) collects your card details, name, email address and billing details at checkout, uses them to take the payment, send your receipt and handle tax, refunds and disputes, and handles them under Stripe's own Privacy Policy. We never see your card details. We can see the other checkout details in our Stripe account, to handle refunds and support, but the game's own servers do not store them.
USDC payments are transfers on a public blockchain: the paying wallet address, our receiving address, the amount and the time are visible to anyone on that network, permanently. To confirm your payment, our server reads the public blockchain through public network endpoints.
For every purchase we keep a record for accounting and tax purposes: the amount and currency, the tax amount when our payment processor calculated it, the buyer's country (for card payments, the billing country from Stripe; for USDC payments, the country of your connection as reported by our hosting provider, Cloudflare), the payment identifiers (Stripe checkout and payment ids, or the blockchain transaction and the paying wallet address) and whether it is paid or refunded. We keep these records as long as tax and accounting rules require, even if you delete your account; they are then no longer linked to it.
What we store
- Your game account: sign-in provider, account identifier (for a wallet, its public address), nickname and picture URL.
- Your game data: scores you submit to the daily ranking (score, level, cures, time) and your saved progress.
- Your logins: a one-way hash of each login key and when it expires (never the key itself).
- Purchase records, as described above.
- If you redeem a promotional code: which code your account used and when (so it works only once per account).
- A salted, one-way hash of your IP address for the day, used only to limit abuse of the ranking, of sign-in requests and of promotional code tries. We do not store IP addresses themselves.
Cookies and storage on your device
The game keeps a few small items in your browser so it can work. They are set by the game itself (zomfoids.com) unless the table says otherwise, none of them is used for advertising or to follow you around other websites, and each one is needed for something you ask for: playing and saving, staying logged in, or buying the game. That is why there is no cookie banner. You can delete them at any time by clearing this site's data in your browser (your progress on this device is then lost unless you are logged in), and Settings → Reset save clears your progress.
| Name (type) | What it is for | How long it stays |
|---|---|---|
zomfoids-save-v1 (local storage) | Your progress, coins, unlocked items, Zomfoid Dex and settings (sound, quality, controls). | Until you reset the save or clear the site's data. |
zomfoids-daily-best-v1 (local storage) | Your best score of the day on this device. | Replaced every day. |
zomfoids-switch-learned (local storage) | Remembers that you already switched weapons once, so the tip stops showing. | Until you clear the site's data. |
zomfoids-session, zomfoids-session-user (local storage) | Keep you logged in on this device: a random login key, plus your nickname and picture link so they show right away. | Until you log out. Our server stops accepting the key after 60 days without use. |
zomfoids-auth-pending (local and session storage) | Security check while a login window is open. | Valid for 15 minutes; deleted when the login ends. |
__Host-zf_xstate (cookie, only while logging in with X) | Security check that ties the X login window to your browser. | Valid for 10 minutes, then your browser deletes it; deleted earlier when the login ends. |
zomfoids-owned, zomfoids-store (local storage) | Remember that your account owns the full game (so it also works offline), and the shop's prices and payment options (nothing about you). | Ownership: until you log out. Shop data: replaced each time the shop loads. |
zomfoids-cloud-base (local storage) | Cloud save bookkeeping: what was already synced for each account used on this device. | Until you clear the site's data. |
zomfoids-usdc-pending (local storage) | USDC payments you sent that are not confirmed yet, so they are never lost. | Until confirmed; 7 days at most. |
zomfoids-nickname (local storage, early versions only) | A nickname chosen in an early version of the game. | Until you clear the site's data. |
__cf_bm, cf_clearance, _cfuvid (cookies set by Cloudflare, our host) | Only while Cloudflare's protection against bots and attacks is active: tells real visitors apart from bots. | A short time (for example 30 minutes). |
Some features load content from other companies, and only when you use them:
- Account / login screen: when you open it, your browser loads Google's sign-in script from accounts.google.com, so Google receives your IP address and browser details and may read its own cookies, under Google's Privacy Policy. Logging in with X opens X's own login page (x.com), where X uses its own cookies under X's Privacy Policy.
- Your profile picture: if you logged in with Google or X, the game loads your own picture directly from Google (googleusercontent.com) or X (twimg.com). Your browser sends no cookies and no page address with these requests, but those servers see your IP address. Other players are shown with their initials, so opening the daily ranking does not make your browser contact Google or X.
- Checkout: card, Apple Pay and Google Pay payments open Stripe's checkout page (Link) in a new tab. On that page Stripe uses its own cookies, for example to prevent fraud, under Stripe's Cookie Policy.
- Crypto wallets: the wallet extension or app you choose (for example MetaMask, Coinbase Wallet or Phantom) is your own software and works under its own terms.
Services that help us run the game
We do not sell your data. We share it only with the services needed to run the game, each for its own job:
- Cloudflare (hosting, database, protection against attacks): stores the data listed above for us and processes IP addresses to deliver the pages (Privacy Policy). Cloudflare also asks browsers that support it (for example Chrome) to send it a short automatic report when one of our pages fails to load because of a network problem ("network error logging"; the browser keeps this instruction for 7 days). The report goes straight from your browser to Cloudflare (a.nel.cloudflare.com) with the page address and the kind of error, and Cloudflare sees your IP address; Cloudflare uses these reports to find and fix problems in its network. Pages that load normally are not reported.
- Google and X: when you log in with them, our server checks your login with them and receives the details listed under "Signing in". We also use Google's Gmail for our support email.
- Stripe / Link: sells and charges card, Apple Pay and Google Pay purchases as merchant of record (see "Payments").
- Blockchain node providers (public endpoints of Base, Polygon, Arbitrum, Ethereum and Solana, or a node provider we hire): our server asks them about your USDC transaction. They receive the transaction id and wallet addresses, which are public anyway; because these requests come from our server, they do not get your IP address. Your own wallet also connects to blockchain nodes by itself (if it needs to add a network, the game suggests a public node for it), and those nodes can see your IP address under their own terms.
Some of these companies process data outside the European Economic Area, mainly in the United States. Those transfers rely on the EU–US Data Privacy Framework or on the European Commission's Standard Contractual Clauses (and the UK equivalents). We do not use advertising trackers, and we do not use your data to train AI models.
Why we are allowed to use your data
- To give you the game you asked for (account, cloud save, purchases, the daily ranking): it is needed to provide our service to you (GDPR art. 6(1)(b)).
- To keep purchase records for tax and accounting: a legal obligation (art. 6(1)(c)).
- To prevent cheating and abuse and keep the service secure and working (for example the salted IP hash, request limits, and Cloudflare's protection against attacks and its network error reports): our legitimate interest in a fair ranking and a working service (art. 6(1)(f)).
- To answer your emails: to provide our service, or our legitimate interest in helping you.
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
How long we keep your data
- Your account, nickname, picture link, cloud save and ranking scores (with their salted IP hash): until you delete your account.
- Logins: until you log out. A login key stops working at most 60 days after you last used it, and expired ones are deleted automatically the next time anyone logs in.
- Login security checks (for an X login, or a message you sign with your wallet): valid for 10 minutes and accepted only once; expired ones are deleted automatically the next time anyone starts the same kind of login.
- USDC payment requests that were never paid: deleted automatically about 8 days after they expire.
- Purchase records: as long as tax and accounting law requires (in Portugal, normally 10 years), even if you delete your account; they are then no longer linked to it.
- Support emails: while we handle your request and for up to 2 years afterwards.
Your rights and choices
You can change your nickname, log out, or delete your account and its game data at any time from the Account screen. You also have the right to ask for a copy of your data (also in a portable format), to correct it, to delete it, to restrict its use, and to object to uses based on our legitimate interests. Email proice526@gmail.com from any address with your nickname; we answer within one month. Purchase records are kept as explained above.
You can also complain to a data protection authority: the Portuguese authority, CNPD (Comissão Nacional de Proteção de Dados), as we are based in Portugal, or the authority of the country where you live (in the UK, the ICO).
For players in the United States
We do not sell or share your personal information as those terms are defined in California law, and we do not use it for targeted advertising. Apart from Google (its sign-in script on the account / login screen), X (its own login page, when you log in with X) and Stripe (its own checkout page), no other company can collect information about your activity on other websites through our site. Because we do not track you across websites, the game works the same whether or not your browser sends a "Do Not Track" or Global Privacy Control signal.
Children
The game is not directed at children under 13, and signing in is not intended for them. If you believe a child under 13 has created an account, email us and we will delete it.
Changes to this policy
If we change this policy we will update the date at the top. If a change is important (for example a new kind of data, or a new company that receives it), we will also tell you in the game before it applies.
Contact
Questions about this policy: proice526@gmail.com