Privacy

Unless you sign up for the closed beta, this site collects no personal data about you: no account, no form, no mailing list, and no cookie of ours. If you do sign up, we hold your email address and either a password you choose or a note that you sign in with Discord or Google, plus the beta access and game diagnostics described below. What follows is the whole of it.

The data controller is TSMW DEVELOPMENT LTD, a company registered in England and Wales under number 17204316.

What we collect

If you sign up for the beta, the form on this site sends what you type to our accounts service at api.damn-zombies.com, which is a machine we run. It holds your email address, your password if you set one (stored only as an argon2 hash, so we cannot read it), whatever you choose to write when you ask for a place, and — once you have a key — which machines the game has used it on and a one-way hash of the addresses it was used from. That last one exists to notice a key being shared, not to follow anybody about.

If you sign in with Discord or Google, we ask them for two things and no more: your email address, and the account number they use for you. We do not ask for your friends, your servers, your contacts, your files or anything you have posted, and we could not read them if we wanted to — the permission we request does not cover them. We store that account number so that you land on your own account next time even if you change your address with them. They will tell you what they are sharing before you agree, and you can take the connection away again from your account settings on their side.

They learn that you signed in here. That is unavoidable in the way it is with any “continue with” button, and it is the reason the email and password form is still there: it involves nobody but us. What they do with that knowledge is covered by their own policies, not this one.

Pressing one of those buttons sets one cookie, on api.damn-zombies.com and not on this site. It holds a random number for ten minutes and is deleted the moment you come back; its whole job is to check that the sign-in that returns is the one that left, and it can identify nobody and follow nothing. It is the only cookie we set anywhere, and it is not set at all unless you press the button.

Two receipts, and the occasional notice. One when your account is made, one when an access extension is approved for you, and now and then a notice about the beta itself — a build you hold being replaced, or an evening on the servers. There is no verification mail, no newsletter, no mailing list and nothing on a schedule — which is why there is no unsubscribe link on any of them: there is nothing to leave. They are sent by Resend, who see your address in order to deliver them. The address is otherwise how you get back into your own page and how we tell one tester from another.

If you do not sign up, we ask for nothing: no name, no address, no cookie of ours, and no advertising pixels or cross-site trackers anywhere on this site. The one thing on any page here that is fetched from somebody else is Twitch’s video player, which is described below.

Two things happen anyway, as they do on any website, and it would be misleading not to say so:

• Visit counts. Vercel Web Analytics records that a page was viewed. It is cookieless and aggregated: no identifier is stored on your device and nothing follows you between sites.
• Server logs. Our host records requests, including IP addresses, for the short period needed to serve the site and keep it up. We do not read them to build a picture of anybody.

The stream, and this one is worth reading. When the game is being streamed, the front page carries Twitch’s own player across the top of it, and an embedded player is a different thing from a link: your browser fetches it from Twitch, so Twitch sees your address and can set its own cookies inside its own frame, exactly as it would if you had opened the channel yourself. What it does with that is covered by Twitch’s privacy notice, not this one, and nothing comes back to us: we are given no figure, no identifier and no list of who watched.

And it happens whether or not anything is streaming. The only way this site can tell that the channel is live — without a server of its own, and it has none — is to load the player and let it say so, so the request to Twitch is made on every visit to the front page and the band is simply not shown when the answer is no. Saying “only while we are live” would be the comfortable version and it would not be true.

Who else sees it

Playtest feedback. If you sign in and submit a feedback form, your answers are stored with your beta account and email so the development team can understand the playtest context. The responses are visible only to the administrator, are not published, and are kept with the account until it is deleted. Avoid putting personal information in written answers or recording links.

Game diagnostics. The game sends small technical session summaries to our accounts service to help diagnose crashes: build, operating system, graphics hardware and driver, performance and memory samples, round and scene, and multiplayer connection events. You can turn these summaries off in Settings → Crash Reports. Full saved game logs, Windows application error details and an optional comment are sent only when you choose “Send crash report”. We remove access keys and common personal details before upload, but please avoid personal information in your comment. Reports are linked to your beta account, visible only to the administrator, and deleted from the diagnostics database after 30 days without an update. A bounded local recovery queue is kept for up to 30 days. We do not collect memory dumps, screenshots, chat, or unrelated files from your computer.

Vercel hosts the site and provides those visit counts.DigitalOcean hosts the accounts service and the game server, which is where a beta account lives. Resend delivers the emails above, and sees only the address they are sent to. Nobody else. Nothing is sold, rented, shared with advertisers or passed on.

The links to Discord on this site are ordinary links out. Follow one and you are on Discord’s service under Discord’s privacy policy, not ours. Twitch is the exception to that and is why it has a paragraph of its own above: its player is embedded rather than linked, so your browser reaches it without your having pressed anything.

How long we keep it

A beta account is kept for as long as the beta runs and is deleted afterwards, or sooner if you ask. Vercel’s analytics are aggregate figures rather than rows about people, and server logs are retained by our hosts on their own short schedule.

Your rights

If you are in the UK or the EU, you have the right to ask what we hold about you, to have it corrected, and to have it deleted. If you have not signed up for the beta the answer is that we hold nothing; if you have, it is the account described above, and asking is enough to have it removed. You can complain to your data protection authority at any time.

We used to run a beta mailing list. It was taken out along with the signup form, and nothing from it is retained.

Contact

Write to contact@tsmwdevelopment.com. The controller is TSMW DEVELOPMENT LTD, company number 17204316.