Privacy Policy

The short version

Almost everything this site remembers about you is kept in your own browser. If you never sign in and never write to us, we hold nothing about you on our servers. We have never sold or shared anyone's data, we run no advertising, and we do not build profiles of visitors. The rest of this page explains the exceptions and your rights.

Who we are

This website, ztools.co.uk, is a community fan project for the mobile game Last Z: Survival Shooter, operated by BD Digital Creations. It is independent, and not affiliated with, endorsed by or connected to Omnilojo Pte. Ltd., Florere Game, or Rivergame.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, BD Digital Creations is the data controller. You can reach us at any time at hello@bddc.co.uk.

What we collect, and why

Kept in your browser

The site saves your preferences and your progress in the tools to your browser's storage — things like your language and timezone, accessibility and layout choices, your cookie decision, and the values you enter into the trackers and planners. This is what makes the tools work and remember where you were. It stays on your device and does not reach us unless you choose to create an account.

Things you actively send us

Some data reaches our servers only because you chose to send it: a contact form message (with anything you attach), a request to join an alliance space, or a screenshot given to the roster scanner. Each is covered in its own section below. We ask for the minimum needed to do the thing you asked for, and we use it for that purpose only.

Technical information

Like any website, ours and the services it relies on receive standard technical information as you browse — IP address, browser user-agent, the page requested and the time. Our host keeps short-term access logs for security and abuse prevention. We do not use this to identify you.

What we never collect

We do not ask for your real name, date of birth, address, or your in-game account credentials, and we never see your card details — donations are handled entirely by the payment provider. We do not buy data about you from anyone.

Lawful bases

We rely on three bases under Article 6 of the UK GDPR, depending on what is happening:

Consent — for anything you actively submit (the contact form, joining an alliance space, the roster scanner, creating an account) and for non-essential analytics. You can withdraw consent at any time, and we say in each section how.
Legitimate interests — for keeping the site running, secure and free from abuse, for storing your preferences on your own device, and for telling you about decisions that affect your access or about a change in how you can reach us. We only rely on this where it would not override your rights.
Legal obligation — where we are required to keep or disclose something by law.

Cookies & analytics

We set no advertising cookies and serve no advertising. Our own preferences are stored in your browser rather than in cookies.

With your consent, we use privacy-conscious analytics to understand which pages are used and where the site is confusing. These are configured in their least-intrusive modes, form inputs are masked, and the data is never used for marketing profiles or cross-site tracking. You can decline or change your mind at any time through Cookie Settings in the footer.

The Cookie Policy lists every cookie, what it does, how long it lasts, and how to opt out of each service individually.

Accounts

Entirely optional. The tools, wiki and guides work fully without one. An account exists so your progress follows you between devices.

If you create one, we store your email address (to identify you and send one-time sign-in codes — there is no password) and the progress you choose to sync. Nothing else: no name, no profile, no behavioural history.

Access is enforced in the database itself, so your saved progress can only ever be read or written by your own account — not by other members of an alliance space you belong to. As administrator, the site owner can technically reach the data; that access is used to run and support the site, not to read it for any other reason.

Your account page lets you see everything held for you, export it, delete your synced progress in one action, leave any space, and switch off optional emails. To delete the account itself, ask us and we will.

Emails your account may get. Nearly everything we send answers something you did — a sign-in code, or a message about a space you belong to. Very occasionally we send a one-off note to everyone with an account about something that changes how the site works or how to reach us. These are rare, never marketing, and never sold or shared. Every copy is addressed to one person: no recipient's address ever appears in anyone else's. Tell us if you would rather not receive even these.

The contact form

The contact form collects what you type, anything you attach, the page you came from, and technical details recorded against the message to guard against abuse. It is checked for automation, emailed to us, and lands in our mailbox — your message is not written to a database, and attachments are never saved to the web server.

We keep correspondence for as long as the history is useful, and no longer than is reasonable for that purpose. Ask us and we will delete it sooner. We never add you to a mailing list, use your address for marketing, or pass it on.

Alliance spaces

An alliance space is a private area for one alliance. This section applies only if you ask to join one; most visitors never do.

To join, you tell us your in-game name, state, alliance tag and rank, so the request can be checked against the alliance in game. Requests are reviewed by hand, and where a space already exists its leadership is asked to confirm they recognise you — they see what you told us, but never your email address.

Inside a space, other members can see your in-game name, rank and role, and anything you publish there is visible to them and attributed to you in the space's activity log. Nobody outside the space sees any of it — membership is enforced at the database level and space pages are not indexed by search engines. Your tool progress is never part of this.

Spaces send you emails about your own membership and about decisions affecting your access; these are not optional while you are a member, because they are the consequence of a decision about you. Content and calendar notifications are optional and can be switched off from your account page. Every email is delivered individually — a message to a whole space is sent as a separate copy to each member, and no member's address ever appears in another member's copy.

You can leave a space at any time. Your membership, in-game name and rank go with you; content you published stays with the alliance but is no longer attributed to you. If you want something you wrote removed, ask that alliance's owners, or us.

The roster scanner

This is the one place on the site where a file you choose leaves your device. Reading a game screenshot accurately needs a vision model, and that cannot run on a phone.

A screenshot you upload is passed through our server to a vision model provider outside the UK, which reads the names, HQ levels and power figures and returns them as text for you to review. We do not store the image — it is streamed through and dropped, never written to disk — and we do not log what was read from it. Saving the reviewed rows to your space is a separate, deliberate step, and only members of that space can see them.

Two things worth knowing before you use it. A Members screenshot is about other people, not only you: uploading it discloses your alliance-mates' in-game names and figures, so only upload one for an alliance you belong to. And the model runs on a free tier, whose providers commonly reserve the right to use submitted content to improve their services — so assume it may be seen, and do not upload anything you would not want a third party to read.

Using the scanner is a choice, and that choice is the lawful basis. Withdraw it by not using the tool; there is nothing stored to delete.

Who your data reaches

We use a small number of established providers to run the site. We do not sell or rent personal data to anyone, and none of these are advertising networks.

Hosting and infrastructure — serving the site and, if you have an account, storing your data (in the EU).
Analytics — anonymised usage statistics, only with your consent.
Fonts and anti-spam checks — loaded from their providers, which receive your IP address in the process.
Email delivery — our mail provider necessarily sees recipients and message contents in transit.
The vision model provider used by the roster scanner, and only when you use it.
Payment providers, if you choose to donate — they handle the payment; we see only the display name and amount.

The Cookie Policy names each service, what it receives and links to its own privacy policy. Links out to other sites — including social share buttons, our Discord, and affiliate links — send nothing until you click them, after which that site's own policy applies. Some outbound links are affiliate links that may earn us a small commission at no extra cost to you; we receive only aggregated commission reports, never your personal data.

International transfers

Some of these providers are based outside the United Kingdom, most often in the EU or the United States, so limited technical data may be transferred there. Where a provider is in a country without a UK adequacy decision, transfers rely on recognised safeguards such as the UK Extension to the EU–US Data Privacy Framework or standard contractual clauses.

The roster scanner is the significant exception: a screenshot you give it is transferred in full, and it contains information about everyone visible on that screen rather than technical data about your browser. That happens only if you choose to use that tool.

How long we keep things

We keep personal data only for as long as it serves the purpose it was given for, then delete it.

Anything stored in your browser — stays until you clear your site data. It never reaches us.
Your account and synced progress — kept until you delete them, which you can do yourself at any time.
Alliance space membership and content — kept while you are a member and while the alliance keeps the space. A space left dormant for a long period is removed, with notice to its leadership beforehand.
Records of decisions — things like a decided membership request, an account suspension, a space's activity log or which terms you accepted are kept for a limited period so a later decision can be judged in context, and because they are the record of an agreement. This includes a note of who we invited or wrote to and when, which necessarily contains the address, so that we can account for our own actions. It is a record of what we did, not a mailing list, and it is never used to contact you again.
Correspondence — kept while the history is useful, and deleted sooner on request.
Email delivery logs — the technical record of a send, including addresses in transit, is kept for hours, not months. The longer-term record of what the site has emailed is counts only — which kind of message, to which space, how many recipients, whether it was accepted — and holds no addresses and no message text.

Third-party services apply their own retention periods; see the Cookie Policy.

Your rights

Under the UK GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time where consent is what we rely on.

Without an account, these are satisfied by default — everything the site knows about you is in your own browser, and clearing your site data removes it.

With an account, the account page is built to satisfy them without asking us: it lists and exports everything held for you, deletes your synced progress in one action, lets you leave a space, withdraw an undecided request, and switch off optional emails. For anything it does not cover — deleting the account itself, correcting a detail, or correspondence — email hello@bddc.co.uk.

If you live outside the UK — in the EEA, Switzerland, California or another US state with comprehensive privacy law — you have substantially the same rights, and we honour them identically. We do not sell or share personal information in the sense those laws use. Email us with the subject “Privacy request”, telling us which right you wish to exercise, and we will respond within 30 days.

Children

The tools, guides and wiki need no account and collect nothing about the person using them, whatever their age.

Accounts are for over-13s only. We do not knowingly hold personal information about a child under 13. We do not ask for a date of birth, so we cannot verify it — but if you believe a child under 13 has an account, tell us at hello@bddc.co.uk and we will delete it and everything held with it.

Changes, and complaints

We may update this policy from time to time; the date at the top always reflects the current version. If a change materially affects how we handle your data, we will make that clear rather than quietly editing the page.

If you are unhappy with how we have handled your data, please tell us first — we would rather fix it. You also have the right to complain to the Information Commissioner's Office, the UK's supervisory authority:

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113

Contact

Any question about this policy, or to exercise any right under it:

BD Digital Creations
Email: hello@bddc.co.uk