Privacy policy

Without an account

Everything you enter or import is saved in your own browser (its local storage) and isn't sent to us. Our hosting provider handles each request to the site and, like any web host, sees your IP address and browser details while doing so.

With an account

If you create an account, we store:

• Your email address and your password. The password is stored hashed, never as you typed it.
• A display name, taken from the part of your email address before the @.
• A record of each sign-in session, including the IP address and browser details it came from, so you stay signed in and so sessions can be ended.
• Your characters: the levels, resources, heroes, buildings and other game details you enter or import, plus each character's in-game name, server, game account ID and when it was last captured.

We use your email address only to sign you in and to send you a password reset link when you ask for one. We don't send marketing email. To slow down password guessing, we also keep short-lived counts of sign-in attempts, tied to the IP address they came from.

Feedback

When you send feedback, we keep your message, the page you were on, anything you put in the optional contact field, and your character's data if you chose to attach it. We also keep your browser details and a scrambled (salted and hashed) form of your IP address, used only to limit how many reports can be sent. If you're signed in, the report is linked to your account.

The capture tool

Last Z Sync runs on your own computer. It reads the game's network traffic while the game logs in, and writes what it finds to Documents\LastZ Sync. It doesn't send anything to us or anyone else. It removes your login token and the email address your game account is linked to before saving anything. Nothing it captures reaches this site unless you import the file yourself.

The iPhone app

Survivor Sync does the same job on a phone. Reading the game's login means carrying its traffic, and iOS gives an app no other way to do that, so the app installs a VPN profile. There is no VPN server: nothing is routed to us or to anyone else. The connection is handled on your phone and passed straight on to the game's own servers.

It runs for seconds, not continuously. It stops on its own once it has read your base, and there is no always-on or background mode. You start it yourself, and iOS shows the VPN badge in the status bar the whole time it is running. The first sync carries all of the phone's connections while it finds the game's server, because that address differs per game server; after that it carries only the addresses it has already found.

Only the game's own connection is saved, and only for as long as it takes to read your base out of it. Everything else the phone does is passed through and discarded — never written down, never logged, never sent anywhere. What was saved is deleted from your phone as soon as it has been read.

Your login token, the email address your game account is linked to, and your sign-in details are removed on the phone before anything is saved or sent. What reaches this site is your game progress: research levels, heroes, gear, buildings, tank talents and items, and the name and server of the account they belong to.

The app signs in by opening this site in a browser window it cannot read, so it never sees your password. It holds a token for your account, kept in the iPhone keychain, which you can revoke at any time from your account page here.

Cookies and tracking

The only cookies we set are the ones that keep you signed in. There are no advertising or tracking cookies, and we don't sell or share your information for advertising.

We use Vercel Web Analytics to see how the site is used. It counts page visits and a few actions, such as importing a capture, downloading the capture tool or applying a hero upgrade, along with general details like the kind of device and the country a visit came from. It doesn't use cookies, and what it records isn't tied to your account, your email address or your game characters. Anything after a "?" in a page's address is removed before it's sent.

Who else handles it

We use a few services to run the site, and they handle your information only to provide those services:

• Vercel, which hosts the site and provides its analytics.
• Neon, which hosts the database.
• Resend, which sends password reset emails.

These services may process information in countries other than yours. We'd also disclose information if the law required it.

How long we keep it

Account and character data is kept until you delete it or ask us to. Deleting a character on My levels removes it straight away. Feedback is kept for as long as it's useful for fixing the problem it reports.

Your choices

You can see and change your characters on the site at any time, and delete any of them from My levels. To have your account deleted, or to get a copy of what we hold about you, send a request through the feedback link at the bottom of any page and include the email address on your account.

Children

The site isn't meant for children under 13, and we don't knowingly keep information about them. If you think a child has created an account, let us know and we'll delete it.

Changes

If this policy changes, we'll update the date at the top of this page. For a significant change, we'll also note it on the site.