Zombie Homestead Privacy Policy

Last updated: October 9, 2026

VAULT LLC (合同会社VAULT; "we") establishes this Privacy Policy ("Policy") as follows regarding the handling of users' information in the game app "Zombie Homestead" ("the Service") that we provide.

---

1. Business operator

2. Information we collect

The Service does not require registration or sign-in. We do not ask for names, email addresses, telephone numbers or postal addresses for registration, and the app has no feature that reads contacts, photos or precise GPS location. We do handle email addresses, Support IDs, messages and attachments sent for support, names entered in the Radio League, and the game data, identifiers and external-service data below. External services may estimate a general region from an IP address.

• Device random ID: a random identifier created on the device at first launch. It is not an advertising ID or a device-specific identifier. Its first 8 characters are shown on the Settings screen as the "Support ID".
• Game progress: progress such as the stages reached, facility levels, number of residents, amount of in-game currency (Gems), and number of plays.
• Device and app information: OS type (iOS / Android), app version, and language setting.
• Radio League information: the title, name, icon, and avatar you set, your scores, number of sorties, and play records (records of character positions and controls, used to replay your play as a "ghost" on other players' screens).
• Invitation information: invite codes, the association between a participant's random device ID and an invite code, and counts of arrivals through invite links. We use these to determine rewards and prevent duplicate counting. We do not ask for participants' real names or contact details.
• Purchase and ad action records: purchase starts, successes and failures, ad-button presses and the stage at the time. Our action statistics use transaction-ID hashes. To verify purchases, grant items, prevent fraud and manage sales and refunds, RevenueCat and our servers handle the random device ID, product and store transaction IDs, purchase, refund and spending data, prices, currencies and paid-Gem balances. RevenueCat validates purchases using store purchase information, receipts and related data. Apple and Google process payments; our app and servers do not receive card numbers or bank-account details.
• Stored save data: a copy of the save, including progress, resources and Gems, purchase state, settings and league information, is automatically sent to our servers for recovery and device transfer. Random authentication keys, transfer codes and passwords are processed during communication and stored on the server as hashes.
• Diagnostic information about defects: the details of crashes and errors (where they occurred and the type of error), device model, OS version, and app version.
• Gameplay analytics (unless turned off in Settings): while "Share gameplay data" is on, the app sends Firebase Analytics gameplay actions and progress, language, purchase status, device, OS and app versions, its app-instance identifier, and events such as launches, sessions and purchases. Google may estimate an approximate region from an IP address. From version 1.0.2, this setting is on by default. If you saved it as off in an earlier version, it stays off; if you never changed it, it turns on after the update. You can turn it off in Settings at any time.
• Inquiry info: if you contact us through the inquiry form, your email address, the type and content of the inquiry, attached images, and any Radio League name, Support ID, device, OS, and app version you enter.

Game save data is stored on your device, and a copy is stored on our servers.

3. Purposes of use

We use the information we collect for the following purposes.

1. To provide the Service (game progression, storing save data and transferring it to another device, Radio League grouping, rankings, and rewards, and invitation rewards)
2. To verify purchases, grant items, prevent fraud, maintain the paid-Gem ledger and sales, refund and ad statistics, and deliver and measure rewarded ads
3. To investigate defects and respond to inquiries
4. To improve the quality of the Service and analyze usage
5. To prevent misconduct and to respond to names and conduct that violate the Terms of Service

4. Information shown to other users in the Radio League

In the Radio League, your title, name, icon, avatar, scores, number of sorties, and play records (ghosts) are shown to users in the same group. Your device random ID is not shown to other users. Please do not include information that could identify you or others, such as a real name or contact details, in your name. Inappropriate names may be deleted so that they are not displayed.

5. About advertising

The Service uses Google AdMob and displays only rewarded ads you choose to watch. Viewing is optional, but the advertising SDK may communicate from app launch to check consent and prepare ads. Google may collect and share advertising and other identifiers, IP addresses and approximate regions derived from them, device information, ad and app interactions, and diagnostics for advertising, measurement and fraud prevention.

• In regions where consent is required, we display a consent screen before showing ads. You can change your choice at any time from "Ad privacy" on the Settings screen.
• On iOS we ask for permission to track across other companies' apps and websites. You can still watch ads if you decline. Declining does not necessarily stop every communication or data operation of the advertising SDK.
• You can reset your advertising ID or turn off personalized ads in your device settings.

For how Google handles data, please see Google's Privacy Policy and How Google uses information from sites or apps that use our services.

6. Diagnosing defects and analyzing usage

• Sentry: we send error and crash details, stack traces, device model, and OS and app versions to Sentry, provided by Functional Software, Inc., for diagnosis and quality improvement. The app removes user data and device identifiers and disables log, screen and save-data attachments. The destination may receive network information such as the sending IP address.
• Firebase Analytics: while "Share gameplay data" is on, the app sends the section 2 analytics to Google LLC's Firebase Analytics. From version 1.0.2 it is on by default (a saved off choice is kept), and Settings lets you stop future Firebase Analytics collection. The app does not pass Support IDs, league names, saves, transaction IDs or receipts to Firebase, and its advertising-ID collection and advertising use are disabled. This switch controls Firebase Analytics alone; it does not collectively stop server progress processing, automatic save backup, purchase verification, the advertising SDK or Sentry. Information sent through Firebase Analytics may also be used to improve Google's own products and services because the GA4 “Google products and services” data-sharing setting is enabled. This sharing setting is separate from the app's disabled Firebase Analytics advertising-ID collection and denied advertising consent. For this use, Google acts as an independent data controller under the GDPR and processes information under Google's own Privacy Policy.

Sentry and Firebase records are not associated with Support IDs, so a Support ID alone may not allow us to locate and delete particular records. Retention and deletion follow each service's settings and terms. For how each company handles data, please see Sentry's Privacy Policy and Google's Privacy Policy.

7. Provision to third parties / outsourcing

Within the scope necessary to provide the Service, we outsource data processing to, or send data to, the providers below. We also use RevenueCat for purchase validation, purchase history, and sales and refund processing.

Other than the above, we do not provide personal data to third parties without the user's prior consent, except as required by law or where necessary to protect a user's life, body, or property.

8. Provision to third parties in foreign countries

The Service's servers and database are located in the United States of America. Some of the above contractors handle data outside Japan. We take appropriate measures, based on each company's agreements and data-processing terms, to ensure that contractors handle data only within the scope of the outsourced purposes. However, for improvement of Google's own products and services through the GA4 sharing setting described in section 6, Google is not a processor limited solely to our instructed purposes. Google acts as an independent data controller under the GDPR and processes information under Google's own Privacy Policy.

9. Data retention and deletion

1. We retain data for the period necessary to achieve the purposes of use, and delete data that is no longer needed.
2. Save data on your device is erased when you delete the app. Save data stored on our servers can be moved to another device using a transfer code and password issued from "Transfer data" on the Settings screen. We keep the latest save data and one daily backup for each of the last 3 days on our servers.
3. To request deletion of server data, note your Support ID in Settings and email game@vault-tec.jp. Continued use sends data again, so remove the app before requesting deletion. After confirming the request and relevant data, we delete progress, league, invitation, save and transfer data, in principle within 30 days. The relevant RevenueCat customer record is also included. Purchase ledger and action records needed for sales and refunds are retained after replacing the random ID to remove the direct association with the game device. Store transaction IDs remain, so these records are not necessarily fully anonymous. A deletion record retains a hash of the random ID, the date and affected row counts.
4. Deleted data, including saves, currency and purchased items, cannot be restored. Support emails and diagnostic and analytics records follow their respective purposes, retention settings, applicable laws and service terms. Payment records independently held by Apple and Google follow their terms. A deletion request does not replace a store refund procedure; refunds follow the relevant store's terms and applicable law.

10. Use by minors

If you are under 18, please use the Service with the consent of a parent or guardian. Parents and guardians should remind children to avoid unnecessary personal information about themselves or others in league names and support messages.

11. Security measures

We take necessary and appropriate measures, such as encrypting communications and restricting access to the admin panel, to prevent leakage, loss, or damage of the data we collect and to otherwise manage it securely.

12. Requests for disclosure, correction, or suspension of use

You may request access, correction, suspension of use or deletion of your data in accordance with applicable law. Send the Support ID shown in Settings to game@vault-tec.jp. We confirm the request and relevant data as appropriate.

13. Changes to this Policy

We may change this Policy in response to changes in laws or in the content of the Service. Material changes will be announced in the Service or on this page.

14. Contact

Please send questions or requests regarding this Policy to the following contact desk.

---

VAULT LLC