Privacy Policy

01Who we are

Overrun is developed and published by Zek Labs, a software studio in Malmö, Sweden. Zek Labs is responsible for the personal data handled through the game (the “data controller” in the words of the GDPR). Questions about this policy go to contact@zeklabs.se.

02In short

• No accounts. There is no sign-up, sign-in or player profile.
• No Zek Labs server. The game never sends your data to Zek Labs. Your progress is saved on your device only.
• Ads. The game shows ads through Google AdMob, which receives device information, described in section 04.
• Purchases. In-app purchases are handled by the App Store or Google Play. Zek Labs never sees your payment details.
• No analytics or tracking of our own. The game contains no analytics, crash-reporting or social SDK, and it never asks for your location, contacts, camera, microphone, photos or files.

03Data stored on your device

Overrun keeps one save file in the game’s private storage on your device. It holds your game progress: levels cleared and stars earned, in-game currencies, unlocks and upgrades, your settings (such as sound, haptics, notifications and personalised ads), the dates the game was first installed and last played, and play statistics such as the number of sessions. It also keeps short fingerprints of your recent purchase transactions, so that a purchase is never delivered twice. The file exists only on your device, is protected by the operating system’s app sandbox and is never sent to Zek Labs.

You can erase it at any time with Reset Progress in the game’s Settings, or by uninstalling the game. Purchases of permanent items (No Ads and the Alphas) can be brought back with Restore Purchases, because the App Store and Google Play keep a record of them.

04Advertising

Overrun shows rewarded videos (which you choose to watch for an in-game reward) and short full-screen ads between levels. They are delivered by Google AdMob, a service of Google (see how Google uses information from apps that use its services). AdMob may fill an ad from Google’s own advertisers or from other ad networks it works with. To show, measure and protect ads, these partners collect from your device:

• Device and advertising identifiers: on iPhone and iPad the advertising identifier (IDFA, only if you allow tracking) and the identifier for vendors; on Android the advertising ID and the app set ID.
• Your IP address, which they may use to estimate your general location (country or city, never your precise location).
• Device and app information, such as the device model, operating system version, language, screen size and the app’s name and version.
• Ad interactions: which ads were shown, whether you tapped them or watched a video to the end.
• Diagnostics about how the ad software performs, such as load times and errors.

They use it to pick and show ads, to cap how often you see the same ad, to measure how ads perform, to pay the right parties and to detect fraud. The data goes directly from your device to them; Zek Labs does not receive it, only aggregated reports (for example how many ads were shown in a country). Each partner handles the data under its own privacy policy, linked above.

Personalised ads need your consent in the EU, EEA, UK and Switzerland. The first time the game starts there, it shows Google’s consent form, which lets you accept, refuse or choose purpose by purpose. If you refuse, you still see ads, but they are not personalised. You can change your answer at any time under Settings › Privacy choices in the game.

On iPhone and iPad, Apple asks whether Overrun may track you across other companies’ apps and websites (App Tracking Transparency). If you choose Ask App Not to Track, the advertising identifier is not shared and the ads you see are less personalised. You can change this at any time in your device’s Settings › Privacy & Security › Tracking.

Elsewhere, you can opt out of personalised ads (the “sale” or “sharing” of personal information under some US state laws) by turning off Personalized ads in the game’s Settings. On Android you can also reset or delete your advertising ID in the device settings (Privacy › Ads), which stops ad partners from linking your future activity to it.

Legal basis under the GDPR: your consent for personalised ads and for storing or reading information on your device for advertising; our legitimate interest in funding a free game with non-personalised ads and in preventing fraud.

05In-app purchases

Purchases are handled entirely by the store you installed the game from: the App Store under Apple’s Privacy Policy, or Google Play under Google’s Privacy Policy. Zek Labs never sees your payment details, your Apple ID or your Google account. The store gives the game a purchase record (the product, the time, a transaction number and a signed receipt), which is verified on your device. The game then delivers what you bought and keeps the short transaction fingerprint mentioned in section 03. Nothing about the purchase is sent to Zek Labs. The stores show us sales reports and handle refunds.

06Notifications

If you allow it, Overrun schedules at most one reminder a day on your device (for example that your horde’s Biomass is full). The reminders are created by the game on the device itself; no push service or server is involved and no data leaves your device. You can turn them off in the game’s Settings or in your device’s notification settings.

07Permissions

On iPhone and iPad, Overrun asks for two permissions, both optional: tracking (App Tracking Transparency, described in section 04) and notifications for the reminders. It never asks for your location, contacts, camera, microphone or photos.

On Android, Overrun declares these permissions:

• Internet, network state and Wi-Fi state, so ads can load and purchases can reach Google Play.
• Advertising ID, which lets ad partners read the Android advertising ID described in section 04.
• Google Play billing and license check, for purchases through Google Play.
• Notifications, only used if you allow reminders (Android 13 and later ask you first).
• Vibrate, for haptic feedback on hits and rewards. You can turn haptics off in Settings.

08The app stores

You install and update Overrun through the App Store, operated by Apple, or Google Play, operated by Google. When you do, they process data about your device and your account under their own privacy policies (linked in section 05). The stores show Zek Labs aggregated statistics about the game, such as install counts, ratings and crash reports, and on the App Store only from people who chose to share them with developers. These do not identify you.

09International transfers

Google is based in the United States and may process ad data there and in other countries. It transfers data from the EU under the safeguards the GDPR provides, such as the European Commission’s standard contractual clauses or the EU–U.S. Data Privacy Framework. Its privacy policy, linked above, describes the details.

10Children

Overrun is made for players aged 16 and over and is not directed at children. We do not knowingly collect personal data from children, and the game’s ad partners do not allow their services to be used with children’s data. If you believe a child is playing, you can delete the game’s data as described in section 03 and reset the device’s advertising ID.

11Your rights

Under the GDPR you have the right to access, correct, delete and receive a copy of your personal data, to object to or restrict its processing, and to withdraw consent at any time (in the game, Settings › Privacy choices). Zek Labs holds no personal data about you on any server, so for data the ad partners hold, contact them through the privacy policies in section 04; resetting your advertising ID also cuts the link to past activity. You can always write to contact@zeklabs.se and we will help.

If you believe your data has been handled unlawfully, you can complain to a data protection authority. In Sweden that is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), imy.se.

12Changes to this policy

When a version of Overrun changes what data is handled, for example by adding an analytics or crash-reporting service, we update this policy before that version is released, name the service, describe what it collects and change the effective date at the top of this page. The current policy is always available at zeklabs.se/overrun/privacy/.

13Contact

Zek Labs · Malmö, Sweden · contact@zeklabs.se