Privacy policy — Backpack Survival

Last updated: 24 September 2026

Controller: Zystam (on Google Play: ZystamDevelopment)

Contact: zystam.dev@gmail.com

This policy covers Backpack Survival and the zystam.eu website, including public and test versions of the game. Which processing applies depends on the version and features you use. Versions before 0.28 store game progress locally with optional Google Play Saved Games synchronisation. Versions from 0.28 introduce a server profile, Ranked and Enemy Players; the section below describes those features when available in your version. Purchases and optional rewarded ads also exist in earlier versions. In version 0.17 the online game services are not active. Enemy Players are computer-controlled copies of player builds, not live opponents. The website is also accessible through zystam.nl when its domain redirect is available.

Delete your account and data

You can request deletion of your Backpack Survival account and associated data by emailing Zystam. Use the subject Backpack Survival — delete account and data. If possible, include your player ID and the Google Play account you use for the game. You do not need to reinstall the game to make a request. Do not send passwords, login codes, access tokens or complete payment details.

We first verify that the request comes from the correct person. We then delete the game account and linked data for which Zystam is responsible, or ask our service provider to delete it. Deletion can cause loss of progress, unlocked items and virtual balances. It does not delete your Google account and is not a purchase refund request.

Minimal purchase or security records may need to be retained for legal obligations, an ongoing dispute, refunds or fraud prevention. We will explain which data we retain in your case, why and for how long. This exception does not automatically apply to your entire profile. We normally respond to privacy requests within one month. If a legal extension is needed, we explain it within that month.

Google also manages its own Play data. You can manage saved Backpack Survival game data in Google Play Games settings. For local data, use Android settings for Backpack Survival. Uninstalling the app alone does not automatically delete account, cloud or purchase data.

Game progress and account

In versions before 0.28, progress, inventory, earned currency, settings and recovery data are stored on your device. When you synchronise through settings, Google Play Saved Games stores a copy of your game profile. When copies differ, you choose which progress to keep. Purchased balances are verified separately by our server. The server profile, Ranked, Enemy Players and run analysis below apply only to versions that offer these features.

Google Play Games handles sign-in; Unity Authentication links it to a Backpack Survival player ID. Google and Unity process account and authentication information for this purpose. Zystam does not receive your Google password.

Our Google Cloud server stores your persistent profile: XP and levels, items, classes, roadmap claims, Essence and Gems, purchases and entitlements, name and discriminator, Ranked rating, seasons and run recovery. Changes are saved automatically. The server version takes precedence when copies differ. During the transition, the server reads your existing Google Play Saved Games profile or, if no Google save exists, imports a validated device save once; original migration data remains available for recovery. Your device may hold cached data, migration backups and pending requests. Audio and language preferences stay on the device.

Unranked uses only previously loaded profile data. An offline run exists only in memory, contains no Enemy Players, grants no persistent rewards and is never uploaded afterwards.

For Enemy Players, at fixed waves we save your class, class level, equipment, item levels, name/discriminator and compatibility information. Another player may see your name and build as a computer-controlled opponent. Each world keeps at most five groups of 250 snapshots; older records are automatically replaced. This does not change your own rating.

Ranked uses Google Play Integrity to check app, installation and device integrity. Google processes technical signals for these checks; our server receives verdicts and verifies their binding to the game request. See the Google Play Integrity overview. We also retain server results and request receipts for reliable rewards, recovery and protection against replayed requests or invalid progress.

An internal, non-public dashboard uses final run results, end-of-run builds, item levels, wave, class, version and rating changes to investigate balance. These analysis records contain no name, payment details or direct account ID. A private pseudonymous owner key links stored results to the account so we can delete them; it is not included in the dashboard or its exports. We process game data to provide the account and game features you request; security and balance analysis also serve our interest in providing a reliable game.

Purchases

Google Play handles payments. Zystam does not receive payment card or bank account numbers. The game sends a purchase receipt and product ID to our server to verify with Google that the purchase belongs to the account and is valid. The server stores account links, derived purchase IDs, products and timestamps, granted and spent Gems or paid Essence, entitlements and reversals. This lets us restore balances and prevent duplicate grants and abuse. The server runs on Google Cloud; the purchase database is configured in a European region.

Unity IAP provides the store integration. This SDK also processes technical data, such as player, installation and session IDs, device characteristics and country, and may process transaction and error diagnostics. This is not Zystam's own behavioural analytics, but it is processing by an integrated service. See Unity IAP's privacy information.

We process purchase data to fulfil and restore purchases and handle payment errors, fraud and reversals. Relevant statutory record-keeping obligations may also apply.

Rewarded ads

From version 0.35 the game requests a rewarded video from Google AdMob first and from Unity Ads only when Google has none. You choose whether to watch a video for a reward. Rewards follow only a completed ad.

Google AdMob and the Google User Messaging Platform (UMP) load when the game starts. In the EEA, the UK and Switzerland the UMP dialog asks for your consent; you can consent, decline or manage options, and change your choice later in Settings › Ad privacy choices. Without consent Google can show only non-personalised or limited ads, or none; the game then falls back to Unity Ads. Google processes, among other things, your device's advertising ID, device and app information, approximate location derived from the IP address, ad interactions and diagnostics, for ad delivery, measurement, operation and fraud prevention. See How Google uses information.

The Unity Ads service also loads when the game starts. The game does not grant Unity consent for personalised ads. Contextual ads also process technical information: for example device and app IDs, device characteristics, approximate location derived from network information, ad interactions and diagnostics. Unity may use and share this data and ad-related purchase information for ad delivery, measurement, operation and fraud prevention. We do not request precise GPS location. Rewards follow only a completed ad.

More information and privacy choices are available in Unity's privacy policy for players. You may also contact Zystam about information Unity processes for us; where Unity is independently responsible, a direct request to Unity may be needed.

Service providers, security and retention

We use Google for Play, sign-in, integrity checks, cloud storage, the profile and purchase backend, and rewarded ads (AdMob and UMP); Unity for authentication, purchases and ads; and STRATO for the website. Network connections to game services are encrypted. The game does not use your camera, microphone or contacts. Zystam has no separate analytics SDK. Our server processes the run results described above for balance analysis; the listed SDKs also have their own diagnostics and processing.

Account and progress information remains available as long as needed for your account and the features you use, or until a valid deletion request is completed. Purchase and recovery records remain necessary while they support balances and transactions; on a deletion request we assess which minimal records must still be retained. Local data remains until you delete it on your device. Independent providers describe retention periods in their own policies. Unity states that IAP service logs are retained for 90 days.

Google and Unity may process data outside the European Economic Area. Safeguards in their privacy and processing terms apply, such as standard contractual clauses where applicable. A European database does not mean that all SDK processing takes place exclusively in Europe. See also Google's privacy policy.

The zystam.eu and zystam.nl websites

Zystam's static website has no advertising trackers, visitor analytics, contact form or embedded social network content. Zystam adds no tracking cookies. Your manual language choice is stored locally in your browser. Without a choice, we follow your browser language preferences, with English as fallback. We do not use location or IP geolocation to select a language. STRATO hosts the website.

When you visit, STRATO processes technical connection data, including the IP address, to deliver pages and detect and prevent attacks. According to STRATO's published information, it retains a complete IP address for this purpose for up to seven days. STRATO provides anonymised webserver logs for the previous six weeks and aggregated graphical statistics for a longer period. Zystam does not maintain its own archive of full IP addresses.

STRATO states that hosting products may use technical session cookies. These are intended for the technical session and, according to STRATO, disappear when you close the browser. Zystam uses this information for its legitimate interest in keeping the website secure and available and investigating technical errors.

See STRATO's information on IP addresses and session cookies and webserver logs and statistics.

Contact and your rights

When you contact us, we process your email address, message and attachments to handle your question or request. We retain these only as long as needed to handle the matter and meet any legal obligations. For support and privacy, email zystam.dev@gmail.com.

You may request access, correction, deletion, restriction or transfer of your personal information. You may object to processing based on legitimate interests and withdraw consent where processing depends on it. Withdrawal does not affect the lawfulness of earlier processing. You may also complain to the Dutch Data Protection Authority.

Changes

We update this policy when data processing changes. The date appears at the top. The privacy information must match the features of the released version of Backpack Survival.