Privacy Policy
Last updated: 23 October 2026
Wrong Shadow ("the app", "we", "us") is a game made by Prabish Rayamajhi. This policy explains what we collect, why, and your choices. Contact: support@zombieinu.com.
1. What we collect
| Data | When |
|---|---|
| Telegram user ID, username and first name, and whether you are a member of our Telegram community, "Join the Pack (community chat)" (checked with Telegram). We never receive your phone number or your Telegram messages. | When you sign in with Telegram (required to play) |
| Sessions: when you start and last used the app, plus a hashed sign-in session credential | When you play |
| Runs and scores: mode, score, souls collected, run length and time, and an optional leaderboard display name you choose | When you play |
| Social clicks: taps on social, community and website buttons (for example "open website", "share on X" or "Join the Pack (community chat)") | When you tap those buttons |
| Device and app info: device model, operating system, app version, platform, user agent string, language, screen size and time zone setting | When you play |
| Install ID (hashed): a random identifier the app creates on first launch and keeps in secure storage on your device. It is not your Android ID or advertising ID, and it needs no permissions. Our server stores only a keyed hash of it, never the raw value, and uses it for rate limiting, security and keeping sign-in tied to your device. It stays on the device after logout and is removed when you uninstall the app. | When you use the app |
| IP address (hashed): our server stores a keyed hash of your IP address, never the raw address, for rate limiting, fraud prevention and security. Kept for 12 months. | When you sign in or use a demo code |
| Join-flow records: when you saw the join page and whether you joined through it, plus a one-use invite link and a pending session | If you weren't in the group when you signed in |
| Server logs (IP address, request, browser) | On every visit, kept by the web server for security and troubleshooting |
| Page-visit stats (pages and game screens viewed, screen size, time zone) | Sent from our site and game to count visits and improve the game; no ad or cross-site tracking |
A strictly necessary login cookie (zi_gate) keeps you signed in for up to 30 days. We don't use advertising or tracking cookies.
We do not collect precise or approximate location, contacts, photos, files or advertising IDs.
2. Why we use it
- To check you can access the game (community membership check) and keep you signed in
- To run the game: save scores, show the daily leaderboard, and prevent cheating and abuse
- To fix bugs, balance difficulty and understand how the game is used (aggregated)
3. What we don't do
- No ads, no advertising SDKs, no in-app purchases
- We do not sell your data and do not share it with third parties for their own purposes
- Telegram handles your sign-in under its own privacy policy (telegram.org/privacy), and fonts on the website are loaded from Google Fonts under Google's privacy policy
4. Where it is stored and how it is protected
Your data is stored in a PostgreSQL database on our own server, operated by us on a virtual private server provided by Hostinger International Ltd in its Kuala Lumpur, Malaysia data center. All traffic between the app and our server is encrypted with HTTPS (TLS, with HSTS enforced). If you are outside Malaysia, your data is transferred there.
5. How long we keep it
| Data | Retention |
|---|---|
| Player data (Telegram ID, username, first name, runs, scores, leaderboard entries) | Until you delete your account |
| Raw session records (including the hashed install ID and the hashed IP address) and click logs | 12 months, then deleted |
| Short-lived login and invite records | Deleted automatically within 24 hours |
| Backups | 7 days, so deleted data disappears from backups within 7 days |
We may keep aggregated statistics that contain no identifiers.
6. Deleting your data
You can delete your account and data at any time at zombieinu.com/tg/delete. You confirm it's you by signing in with Telegram. Deletion removes your player record, sessions, runs, scores and leaderboard entries; backup copies expire within 7 days. You can also contact us at support@zombieinu.com. Leaving the Telegram community stops access to the game but does not by itself delete your data.
7. Children
Wrong Shadow is for players aged 13 and older, because signing in requires a Telegram account. We do not knowingly collect personal information from children under 13 (or the minimum age in your country). If you believe a child under 13 has given us information, contact support@zombieinu.com and we will delete it.
8. Security
We use HTTPS (TLS + HSTS), store session credentials only as hashes, and limit access to the server. No method is 100% secure.
9. Changes
We'll update this page and the "Last updated" date if anything changes, and tell players in the app about significant changes.
10. Contact
Prabish Rayamajhi, support@zombieinu.com, zombieinu.com