Privacy Policy
This policy explains what information ZEXP ("we", "us") collects when you play Nonna Said Run (on Android through Google Play, in a web browser, and in any future PC version) and when you visit zexp.dev, why we collect it, who we share it with and the choices you have. If you have questions, email support@zexp.dev.
The short version
- You don't need an account to play, and we don't ask for your name, email, location, contacts, photos, camera or microphone.
- Your progress and settings are saved on your device. They are not sent to us.
- If you choose to send a bug report or feedback, we receive your message and some technical details about the game and your device.
- The Google Play version shows optional rewarded ads from Google, which collects device data as described below.
- We don't sell your data, and we don't use analytics or tracking tools of our own.
1. Information stored on your device
The game saves the following locally on your phone or in your browser: game progress (coins, unlocked heroes, weapons and skins, stats and best scores), the in-game name you choose, audio and control settings, a timer that limits how often ads can be offered, and your Player ID (see below). This data stays on your device and is removed when you uninstall the app or clear its data (or clear your browser's site data).
2. Player ID
The game creates a Player ID that looks like NSR-ABCD-2345. On Android it is made by passing the device's app-specific Android ID through a one-way hash, so the original identifier can't be recovered from it. In a browser it is a random code. We use the Player ID only to match bug reports to the same player and to block players who abuse the game or the report system. It is not linked to your real name, email or advertising ID.
3. Bug reports and feedback (only when you send one)
The game has a Report button. If you choose to send a report, we receive:
- the message you write and the report type (bug, feedback or idea);
- a screenshot of the game, only if you leave the screenshot option ticked;
- your Player ID and in-game name;
- game details: version, current screen, hero, weapon, stage, wave, active powers, coins, cookies and player level;
- device details: device model, operating system and browser version (the "user agent"), screen size and pixel density, and whether you are playing in the app or a browser.
Reports are delivered to a private channel on our Discord server using Discord's webhook service. Like any internet request, this also reveals your IP address to Discord. We use reports only to fix bugs, balance and improve the game, and to stop abuse.
4. Advertising (Google Play version)
The Android version can offer optional rewarded ads: you choose to watch an ad in exchange for an in-game reward. These ads are provided by Google AdMob (Google Mobile Ads SDK). When an ad is requested or shown, Google may collect and process information such as your device's advertising ID, IP address, device and operating system details, app information and ad interactions. It uses this to deliver and measure ads, limit how often you see them and prevent fraud, and, where permitted, to personalize ads. We do not receive this information from Google in a form that identifies you.
You can reset or delete your advertising ID, or opt out of personalized ads, in your Android settings (Settings → Google → Ads, or Settings → Privacy → Ads). Learn more in how Google uses information from apps that use its services and in Google's Privacy Policy. Test and browser builds show a placeholder instead of a real ad and do not load Google's ad service.
5. Other technical connections
- Fonts: the game and this website load fonts from Google Fonts, which receives your IP address and browser details when the fonts are downloaded. See Google Fonts privacy.
- Ban list: the game may download a list of blocked Player IDs from our server. This request contains no personal data beyond the technical information any web request includes, such as your IP address.
- Google Play: downloads, purchases, reviews and crash reports handled by Google Play are covered by Google's Privacy Policy.
6. Our website (zexp.dev)
- Hosting: zexp.dev is hosted by Cloudflare, which processes technical data (such as IP address, browser and requested pages) to deliver the site and protect it from attacks.
- Playtest registration: if you register for a playtest, we collect your name and surname, the Google Play email address you give us, whether you have tested games before, and your answer to our "ready to beat the monsters" question. This is sent to a private channel on our Discord server. We use your email only to add you to the Google Play test and to contact you about it.
- Tester password: if you unlock the test build, a small note is saved in your browser for 7 days so you don't have to enter the password again.
- Emails: if you email support@zexp.dev, we use your message and address to reply. Our email is forwarded through Cloudflare Email Routing to our Proton Mail inbox.
The website doesn't use advertising or analytics cookies.
7. Who we share information with
We do not sell or rent your personal data. We share it only with the service providers below, only as needed to run the game and the website, or when the law requires it:
| Party | Why | What |
|---|---|---|
| Google (AdMob) | Rewarded ads in the Android version | Advertising ID, IP address, device and ad interaction data |
| Google (Play, Fonts) | App distribution, font delivery | As described in Google's policies; IP address for fonts |
| Discord | Receiving bug reports and playtest registrations | Report contents and device details; playtest form answers; IP address |
| Cloudflare | Website hosting, security and email forwarding | Technical request data; emails you send us |
| Proton | Our email inbox | Emails you send us |
We may also disclose information if required by law or to protect the safety of our players, our team or the public.
8. How long we keep it
Data on your device stays until you delete it. We keep bug reports and playtest registrations for as long as they are useful for development and testing, and no longer than 24 months, unless you ask us to delete them sooner.
9. Legal bases (EEA, UK and similar laws)
We process report and registration data with your consent, which you give by choosing to send it. We process the Player ID and technical data on the basis of our legitimate interest in running a stable, fair game and a secure website. Google processes ad data under its own legal bases and, where required, with your consent.
10. Your rights and choices
Depending on where you live, you may have the right to access, correct or delete your personal data, to object to or restrict its processing, to data portability, and to withdraw consent at any time. To make a request, email support@zexp.dev. Include your Player ID (shown in the game) for reports, or the email you registered with for playtests. You can also complain to your local data protection authority. You can stop all data collection by the game at any time by not sending reports, not watching ads and uninstalling the app.
11. International transfers
Our service providers may process data in countries outside your own, including the United States. Where this happens, they rely on recognised safeguards such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.
12. Children
Nonna Said Run is not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has sent us personal data, contact us and we will delete it.
13. Security
All connections to our website and the services we use are encrypted with HTTPS. Access to our Discord channels and inbox is limited to the ZEXP team. No method of transmission or storage is 100% secure, but we work to protect your information.
14. Changes to this policy
If we change how the game or website handles data, we will update this page and the date at the top. Important changes will also be announced in the game or on our Discord.
15. Contact
ZEXP · support@zexp.dev · zexp.dev