Privacy Policy

Last Updated: August 2026

NotAZombie, Inc. is the controller of personal data processed through this service. To contact us, use our feedback form.

1. Information We Collect

1.1 Information you provide to us:

  • Email address (when registering or joining our mailing list)
  • Google account information (if you choose to sign in with Google)
  • Profile information, which includes:
    • Basic information (age, gender, location, dating preferences (interested in))
    • Profile text and descriptions
    • Profile and tile customization preferences (colors, styles)
    • Profile visibility settings
    • Photos and images you upload
    • Questionnaire responses and preferences
    • Any additional information you choose to share in your profile
  • Location data (if you choose to share it for matching purposes)
  • Communication preferences
  • Messages and communications with other users
  • Reports and feedback you submit about other users
  • Block list and interaction preferences
  • Payment records when you send an optional tip or contribution (amount, currency, status, and processor transaction identifiers). Full payment card numbers are handled by our payment processor, not stored by us.

Legal bases

We process personal data for these reasons:

  • Contract: to create and run your account, show profiles, operate browse and messaging, process tips or contributions you choose to send, and provide the service you asked for.
  • Legitimate interests: to keep the service secure, prevent fraud and abuse, measure first-party visits on our own servers, and understand how the product is used (analytics) where local law allows.
  • Consent: email marketing if you opt in. You can unsubscribe in those emails or in settings.
  • Legal obligation: where we must keep or disclose information (for example safety reports, accounting and tax records for payments, or a lawful request).

1.2 How we use this information:

  • To create and maintain your account
  • To show relevant matches based on your location and questionnaire responses
  • To display your profile, photos, and relevant questionnaire responses to other users
  • To send important notifications about your account
  • To send marketing communications (if you've opted in)
  • To operate browse (restore your feed, apply filters, and enforce usage limits)
  • To process optional tips and contributions, prevent payment fraud, and keep related records

1.3 Data Sharing and Visibility:

  • Public Profile Information: By default, your profile information, photos, and questionnaire responses are publicly viewable to anyone visiting the site, including visitors who are not logged in
  • Profile Visibility Controls: You can adjust some aspects of your profile visibility through privacy settings, but please be aware that core profile elements remain publicly accessible
  • Search Engine Visibility: Your profile may be indexed by search engines unless you change your profile visibility settings

1.4 Information collected automatically:

  • Session data (necessary for website functionality)
  • First-party cookies described in Section 2 (including visitor and timezone cookies used to run the service)

1.5 Analytics data we collect:

  • Usage information (pages visited, time spent on site, referring sites)
  • Device information (browser type, operating system, screen resolution)
  • Location data (country and city level, not precise location)
  • Traffic sources and user flow through the site

1.5.1 First-party site visit measurement

In addition to third-party analytics tools listed below, we record session visits on our own servers to understand traffic and improve the service. This happens once per browser session when you load certain pages (including the public landing page and, when signed in, after you log in).

  • What we store: approximate country derived from your IP address, browser language, timezone, screen size, device type, referring website or campaign link (for example a print ad QR code with ?ref=), and—if you are signed in—your account identifier
  • Anonymous visitors: we use a first-party cookie (nz_visitor) to distinguish unique browsers without requiring login; this cookie is not used for advertising
  • IP address: used to derive country and then stored with the visit record for fraud prevention and aggregate analytics; we do not use it to track you across other websites
  • Campaign links: if you arrive via a tagged link (such as ?ref=ad:… on a poster or flyer), we store that tag so we can measure which materials drive visits

Referring websites may not always be transmitted by your browser or the site you came from; in those cases the visit may be recorded as direct or unknown. For more on third-party analytics, see Section 3 below.

1.6 How we use analytics data:

  • To analyze site usage patterns and improve user experience
  • To identify and fix technical issues
  • To understand which features are most popular
  • To measure the effectiveness of our site improvements

1.7 Message and Communication Data

  • We store messages you send and receive through our platform
  • Message content is stored securely and is only accessible to conversation participants and our moderation team when investigating reports
  • Messages may be retained after a conversation is closed for moderation and legal compliance purposes
  • When you report a user, recent messages from that conversation are attached to the report for review

1.8 Report and Block Data

  • When you report a user, we record the report reason, any additional details you provide, and relevant conversation history
  • Report data is used to investigate violations and enforce our Terms of Service
  • We maintain records of users you have blocked to prevent unwanted contact
  • We do not share report details with the reported user

1.9 Browse and usage data

  • Browse filter preferences you set (such as age range and distance)
  • Feed state used to restore the browse experience (such as the order of tiles shown to you and your position in that order)
  • Interaction and activity records related to browse and messaging (for example, viewing a Tile or profile, or messaging activity), including metadata we need to run the service and enforce limits
  • Usage counts where we apply limits (such as daily profile or tile views)

2. How We Use Cookies

We use the following cookies:

  • Essential cookies:
    • Laravel session cookie for maintaining your login session and authentication state
    • A longer-lived remember-me cookie if you ask to stay signed in
    • CSRF token cookie for protecting against cross-site request forgery
    • XSRF-TOKEN cookie for secure form submissions
    • nz_visitor for anonymous visitors, so we can distinguish unique browsers for first-party visit statistics (not used for advertising)
    • nz_timezone to remember your browser timezone for features such as daily usage limits

We use Google Analytics and PostHog only where local law allows it. We estimate your country from your IP address; where we do not use those tools, they never load.

Our session cookies are encrypted, HTTP-only, and use same-site protections to ensure security.

3. Third-Party Services

We currently use:

  • Google Authentication for sign-in functionality
  • Google Analytics for website usage tracking and analysis
  • PostHog for product and usage analytics on our application
  • Google reCAPTCHA Enterprise to protect our forms from spam and abuse (this may load Google scripts when those forms are shown)
  • SendGrid for email communications
  • Mailgun for contact form processing
  • GoDaddy for web and database hosting
  • A payment processor for optional tips and contributions

Analytics tools run where local law allows.

3.1 PostHog

Where local law allows, we use analytics tools to understand how the product is used. This is not optional in those places.

We use PostHog, a product analytics service, to understand how features are used and to improve the service. PostHog processes information such as device and browser characteristics, pages or screens viewed, and custom events (for example sign-up progress, profile actions, or messaging-related actions—depending on what we measure over time).

When you are signed in, we may associate analytics data with your account by sending your internal user identifier and email address to PostHog so we can analyze authenticated usage. Processing may occur in the United States and elsewhere according to PostHog’s infrastructure. For details on how PostHog handles personal data, see the PostHog Privacy Policy. To exercise privacy rights related to this processing, contact us through the feedback form.

We may send a bucketed gender value (Male, Female, or Custom) to PostHog so we can analyze usage by gender. We do not send other special-category profile attributes to PostHog, Google Analytics, or any other analytics processor, for any user. That includes dating preferences, religion or other questionnaire answers, photos, profile text, custom gender free-text, and the content of messages. When we record that a message was sent, we send identifiers such as a conversation id—not the text of the message.

PostHog session replay is on. Message content is masked in the browser before recordings are sent, including the chat composer, message bubbles, and inbox previews. Interaction autocapture is disabled so that clicks and form text are not collected into event properties. Page views may still be recorded. These client settings were verified on 24 August 2026.

4. Data Storage and Security

Your data is stored on secure servers provided by our hosting provider, GoDaddy. Our databases are hosted on GoDaddy's servers located in the United States. Session cookies use secure settings including HTTP-only and same-site protections.

4.1 Data Retention

  • Active account data: Stored as long as your account is active.
  • Photos and images: Stored until removed by you or your account is deleted.
  • Questionnaire responses: Maintained as part of your profile until changed or your account is deleted.
  • Browse filters, feed state, interaction/activity records tied to browse and messaging, and usage counters: Generally removed when your account is deleted, except where this policy states otherwise (for example, information retained with safety reports).
  • Messages: Deleted when either conversation participant deletes their account.
  • Reports: Permanently retained for safety and legal compliance, even after account deletion. When you report a user, we capture their identifying information (email, name, date of birth, gender, location) and message evidence at the time of the report. This data is retained to enable investigation of harmful behavior and cooperation with law enforcement if necessary.
  • Block records: Retained even after account deletion (anonymized).
  • Tip and contribution records: Kept as needed for accounting, tax, fraud prevention, and legal obligations, which may be longer than an active account.
  • Deleted accounts are immediately removed from active systems, except for report-related data and payment records retained as noted above.

4.2 Third-Party Data Processors

  • GoDaddy: Hosts our databases and web servers (United States)
  • Google: Provides authentication, Google Analytics (where local law allows), and reCAPTCHA for form spam protection
  • SendGrid: Processes and handles email communications
  • Mailgun: Handles email communications
  • PostHog: Product and usage analytics where local law allows (processing location described in PostHog’s documentation and terms)
  • Payment processor: Processes tip and contribution payments (card data is handled by the processor)

5. Your Rights

Depending on where you live, you may have rights regarding your personal data. These can include requesting access or deletion, correcting inaccurate information, objecting to or limiting certain processing, and withdrawing consent where processing is based on consent.

  • You can update much of your information directly in your account settings
  • You can withdraw consent for email marketing as described in those messages or in settings
  • For other requests—including a copy of personal data we hold about you—please contact us as described below

5.1 Access, export, and requests

Your account may include an option to download part of your information as a JSON file (for example, core account fields, profile-related data we associate with your account, and related preferences). That download is provided for convenience and does not necessarily include every category of personal data we process (such as messages, photos stored as separate files, detailed activity logs, or records kept for safety and reporting).

To request a copy of personal data we hold about you, to ask about categories of data we process, or to exercise other privacy rights, please contact us through our feedback form. We may need to verify your identity before fulfilling certain requests. We will respond as required by applicable law.

5.2 Account Deletion

When you request account deletion:

  • Your profile and personal data will be immediately deleted from our active systems
  • However, your information may persist in our backup systems for up to 90 days
  • These backups are used only for system recovery and cannot be accessed for normal operations
  • After 90 days, your data will be completely removed from all backup systems

6. Contact Information

For privacy questions or to exercise your rights, use our feedback form.

7. Changes to This Policy

This privacy policy may be updated as we add new features and functionality. We will notify users of any material changes.

8. Children's Privacy

Our service is not intended for and does not knowingly collect information from users under 18 years of age.