Player data · clear version
Privacy without the fog machine.
Account-system notice · August 14, 2026
Dead VS Zombies is a free browser game. You can play without an account. If you choose phone sign-in, we use the minimum information needed to verify your number, keep you signed in securely, and provide optional cross-device progress.
What we collect
- Your mobile number when you request an account code.
- Verification and delivery status from Twilio Verify. The code passes through our server to Twilio for approval; Twilio remains the authority, and the app does not retain that provider code as account data.
- Account and session records such as a player ID, display name, sign-in time, expiry, browser user agent, and IP address used for session security.
- Game progress you explicitly connect, including mission results, earned and spendable stars, unlocks, upgrades, selected loadout, and hero progress. A separate browser backup stays on your device.
- A random browser-installation identifier used only to recognize the last device that updated a cloud save and make conflicts safer. It is not an advertising identifier.
Why we use it
We use this data to prove that you control the number, create and protect your player account, prevent automated abuse, let you review or end sessions, and support export or deletion requests. Verification texts are transactional account messages—not advertising—and we do not use phone sign-in as consent for marketing.
Guest play stays separate
You do not need to provide a phone number to play. A signed-in player explicitly chooses whether the browser or cloud save should win on first link or a cross-device conflict. Deleting an account removes its cloud profile but does not silently erase the backup stored separately in this browser. Clearing browser site data may erase that local backup.
Who processes it
Twilio processes phone verification and SMS delivery. OpenAI Sites and its Cloudflare-backed runtime host the application, account database, and first-party sessions. Mobile carriers also process SMS delivery. Each provider may retain operational, fraud-prevention, security, or legally required records under its own policies.
Security and retention
Provider credentials stay on the server. Session cookies are first-party, HTTP-only, secure in production, and revocable. Cloud writes are authenticated, same-origin, size-limited, normalized to the current profile schema, and protected by an expected revision so one device cannot unknowingly overwrite a newer revision. Active account, cloud profile, and session data remains while the account exists; expired sessions and abuse-control records are retained only as needed for operation and security.
Your controls
- Play without an account.
- Change your verified number after proving control of the new number.
- Review active sessions and sign out other devices.
- Download the server-side account export, including connected cloud progress.
- Permanently delete the account and its cloud progress from the account dashboard.
Twilio and carriers may retain delivery or security logs that the game cannot directly erase. The account screen says this before deletion.