Privacy policy

Version: 14 September 2026. These documents cover Zombie Blast Cart, displayed on devices as Zombie Cart.

1. Who is responsible for your data

Support: contact@mindmotiontech.com
Privacy enquiries: contact@mindmotiontech.com

The publisher of the game is the controller of personal data processed to provide the game and respond to your requests; contact details are listed above. This policy covers the mobile game and contact with its publisher. External stores, advertisements and linked websites have their own privacy information. Our public document pages do not extend this policy to unrelated services on those websites.

2. Local game data

Campaign progress, equipment, preferences and a record of purchase entitlements are stored on your device. Optional Google and Apple sign-in uses Firebase Authentication. Firebase processes the provider identifier, email address and display name you share, along with connection and security information, to maintain and protect your account. Native Firebase credentials persist on your device until you sign out. The game does not receive your Google or Apple password. You can delete the game account in Settings. The game has no chat, user uploads or campaign cloud save. We do not receive your campaign progress through a gameplay analytics service. Device or operating-system backups may contain local app data under your backup settings. Removing local data can permanently remove your campaign; restoring purchases does not restore the campaign.

Paid run supplies

Your Firebase account is linked to a generated RevenueCat customer ID. Our Firebase Functions and Firestore backend stores this mapping and paid run requests, including the chosen boost, stage, difficulty and whether the run has started. RevenueCat holds your remaining supply balance. This lets you recover remaining supplies by signing in with the same account on another device. Campaign progress stays local. Paid boosts require an internet connection. Run receipts prevent duplicate use and remain until you delete the account.

3. Purchase and connection information

The game connects to RevenueCat when it starts and when you open or refresh the store, purchase an item or restore purchases. RevenueCat uses a generated app user identifier, app and platform information, product and transaction identifiers, purchase dates and entitlement status to verify purchases, enable content, detect transaction abuse and provide purchase reporting. A generated identifier is not your name, but can still identify an app installation or purchase record.

Apple or Google processes checkout and the store account according to its own terms. The game does not receive your full payment-card information. Network services necessarily receive connection information such as an IP address. We do not send your email address or name to RevenueCat as a customer attribute. If you contact support about a transaction, the information you supply may allow us to connect your request to a purchase record.

4. Optional advertisements

Rewarded ads are optional. Google AdMob and its privacy-choice service may process an IP address and derived approximate location, device or app identifiers, viewed ads, video views and other ad interactions, performance information, crash information and privacy choices. These support ad delivery, reporting, security and fraud prevention. The game does not ask for precise GPS location.

We request non-personalized ads and do not request permission to access Apple's advertising identifier through App Tracking Transparency. Non-personalized ads still involve data processing and may use device storage. Where required, the consent interface explains applicable purposes and providers before ads can be requested. Declining optional consent does not prevent ordinary gameplay, although a rewarded ad may be unavailable. Opening an advertiser's destination is subject to that destination's privacy policy.

5. Support messages

If you email us, we receive your email address, message and any attachments or transaction details you choose to provide. We use these to answer you, investigate the issue and handle complaints or privacy requests. Our email service processes correspondence for delivery and storage. Do not send passwords, full card details or unnecessary identity documents. We may ask for limited additional information when necessary to locate a record or verify a request.

6. Purposes and legal bases

Where the GDPR or equivalent rules apply, we rely on performance of a contract for providing requested game features, purchases and related support (Article 6(1)(b)); consent for optional advertising storage or processing that requires it (Article 6(1)(a)); legal obligations for applicable record-keeping and rights requests (Article 6(1)(c)); and legitimate interests in securing the service, preventing fraud, resolving disputes and understanding purchase performance (Article 6(1)(f)). These interests are assessed against your rights. A legitimate-interest basis does not replace consent where consent is required for device access or advertising.

Local storage needed for progress and your requested settings supports the game you choose to use. You can play without purchasing or watching ads. Purchase verification cannot work without the information needed to verify the transaction. Support requires enough information to understand and respond to your request. We do not use your data to make automated decisions producing legal or similarly significant effects on you.

7. Recipients and international transfers

RevenueCat, Inc. processes purchase-service data for us under its Data Processing Addendum. Google provides Firebase Authentication, Firebase Functions, Firestore, advertising and privacy-choice services; Apple and Google operate their stores. Their roles and responsibilities for their services are described in their applicable terms. Authorised service providers may process data for hosting, delivery, support or security. We may disclose information where required by law or necessary to establish, exercise or defend legal claims.

Service providers can process information outside your country, including in the United States. For transfers subject to EEA or UK restrictions, applicable safeguards include adequacy decisions or standard contractual clauses and the relevant UK addendum where required. RevenueCat's DPA describes its transfer safeguards. Google's transfer information is available in its data transfer frameworks. Contact us for information about safeguards applicable to your data.

Provider information: Google Privacy Policy, RevenueCat Privacy Policy, and Apple Privacy Policy.

8. How long data is kept

Local game data remains on your device until removed by you or the operating system; backups follow your backup settings. Purchase records are kept while needed to verify and restore entitlements, resolve payment disputes and satisfy applicable legal retention requirements. Support correspondence is kept while needed to resolve your request and, where necessary, for the applicable period for related legal claims. Information no longer needed for these purposes is deleted or anonymised.

Advertising and store providers apply retention periods appropriate to their purposes and obligations, as described in their policies. Removing the app does not itself delete provider-held information. Where a deletion request cannot be fully granted because a record is legally required or needed for a legal claim, we explain the reason and restrict its use to that purpose. Contact us for the retention criteria applicable to a particular record.

9. Your choices and rights

Depending on applicable law, you may request access, correction, deletion, restriction or portability of your personal data, and object to processing based on legitimate interests. You may withdraw consent at any time; this does not make earlier lawful processing unlawful. Contact contact@mindmotiontech.com. We do not require creation of a game account to submit a request. You may also complain to your competent data-protection authority; in Poland this is the President of the Personal Data Protection Office (UODO).

We respond within the period required by applicable law. For GDPR requests, this is normally within one month; where a permitted extension is needed, we inform you within that month and explain why. We may need proportionate verification and will explain if we cannot identify the relevant records. We do not collect extra identifying data solely to identify every player.

10. Children and security

The game is intended for players aged 13 or older. A higher regional store age rating must also be respected. We do not knowingly solicit personal information from children below the intended age. Contact us if you believe such information was provided, so we can investigate and take appropriate steps. Where local law requires parental authorisation for a minor, that authorisation is necessary.

Access to provider dashboards and support information should be limited to authorised personnel. Data transmitted by the integrated services uses their secure connections. No system guarantees absolute security; keep your device and store account secure.

11. Policy changes

The current policy is available in Settings and on our public policy page. We update the version date when the text changes and provide additional notice or request renewed consent where required before a material change takes effect.