Hold the Wall – Privacy Policy

Hold the Wall: Zombie Siege · Effective date: 21 October 2026

In short: your game progress stays on your phone and we never ask for your name, email or phone number. To run and grow the game we use Google Firebase (analytics), Google AdMob and other ad networks (ads), advertising and measurement partners such as Meta, Google and TikTok (to measure our ad campaigns), and Google Play / Apple and RevenueCat (purchases and subscriptions). We do not sell your data for money. Players under 13 play in a kid-safe mode without analytics or personalized ads. You can opt out of personalized ads, and ask us to access, correct or delete your data at any time: joshua@minimumillion.com.

1. Who we are

The mobile game Hold the Wall: Zombie Siege (the "Game") is published by Minimum Illion Limited, a company incorporated in the Hong Kong Special Administrative Region, trading as Minillion Studios ("we", "us"). We are the data user (data controller) responsible for the personal data described here.

Registered address: 39/F, The Center, 99 Queen's Road Central, Hong Kong
Privacy contact (Data Protection Officer): Joshua, joshua@minimumillion.com

2. What we collect, why, and who receives it

Data	Purpose	Collected by / shared with
Game progress and settings (levels, coins, gems, upgrades, sound and reminder settings, the age range you choose on the first screen)	Saving your game; applying the right privacy settings for your age	Stored only on your device. Not sent to us.
Game activity (levels started and finished, upgrades, rewards, ads watched, purchases made), app version, device model, operating system, language, an app-instance identifier, approximate location (country or region, from IP address)	Analytics: understanding how the Game is played, fixing problems and improving balance (not for players under 13)	Google LLC (Firebase Analytics), as our service provider
Advertising ID (Android Advertising ID / Apple IDFA where you allow it), IP address, device information, ad views and clicks	Showing ads in the Game and measuring them; personalized ads only where allowed and, where required, with your consent (never for players under 16)	Google LLC (AdMob) and the ad networks and ad technology providers it works with
Install and campaign data: which advertisement (if any) led you to install the Game, install time, and in-game events such as tutorial completed, level reached and purchases made, linked to your Advertising ID or app-instance identifier	Measuring and improving our own advertising campaigns (attribution), and finding new players with similar interests (lookalike audiences) (never for players under 16)	Advertising and measurement partners we use to promote the Game, such as Meta Platforms (Facebook, Instagram), Google (Google Ads, Firebase), TikTok, AppLovin, Unity, Mintegral, Moloco and Liftoff, and mobile measurement partners such as AppsFlyer or Adjust
Purchase and subscription records (product, time, store receipt, VIP Club subscription status and renewal date) and a random anonymous user ID created by the Game	Delivering, validating and restoring in-app purchases and subscriptions; preventing fraud	Google Play / Apple (payment processing) and RevenueCat, Inc. (purchase validation)
Emails you send us	Answering support and privacy requests	Us only

We do not collect your name, email address (unless you write to us), phone number, contacts, photos, precise location, or payment card details. Payments are handled entirely by Google Play or Apple. We do not collect sensitive personal information and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Supplying data is voluntary. You can play without making purchases, and you can refuse or withdraw ad and analytics consent where offered. If you do, the Game still works; you may see non-personalized ads.

We do not sell your personal data for money and we do not use it for direct marketing to you. Advertising and measurement partners act under their own privacy policies for the data they receive; we only share the minimum needed to show and measure ads.

3. Your choices

Consent (EEA, UK, Switzerland): before any personalized ads, analytics storage or advertising measurement, the Game shows Google's consent message. You can change your choice any time in the Game: Settings → Privacy Choices. Until you consent there, analytics storage and ad personalization stay off.
Opt out of personalized ads anywhere: on Android, reset or delete your Advertising ID in your phone's Settings → Privacy → Ads (or Google → Ads). On iPhone, we ask permission before your IDFA is used for tracking; you can change this in Settings → Privacy & Security → Tracking. Without an advertising ID, ad partners cannot link your activity across apps.
Reminders: if you allow notifications, the Game shows reminders (for example when your coins or daily reward are ready). They are created and scheduled on your phone only, contain no ads, and send no data to us or anyone else. Turn them off in the Game (Settings → Reminders) or in your phone's notification settings.
Delete your game data: Settings → Reset Progress in the Game, or uninstall the Game. To have data held by our providers deleted, email us (see section 4).

4. Your rights

Hong Kong (Personal Data (Privacy) Ordinance, Cap. 486): you may request access to and correction of your personal data. We will respond within 40 days. We may charge a fee that is not excessive for a data access request. Send requests to joshua@minimumillion.com or to our registered address, marked "Data Protection Officer".

EU / UK (GDPR / UK GDPR): you may also ask us to erase or restrict your data, object to processing (including for advertising measurement), receive a portable copy, and withdraw consent at any time (this doesn't affect earlier processing). You may complain to your local supervisory authority (in the UK, the ICO).

United States (California CCPA/CPRA, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other state laws): you may request to know, access, correct and delete your personal data. We do not sell personal data for money. Using advertising identifiers to show personalized ads or to measure ad campaigns may count as "sharing" or "targeted advertising" under some state laws; you can opt out at any time by resetting or deleting your Advertising ID (see section 3), through Settings → Privacy Choices where it is shown, or by emailing us. We won't discriminate against you for using your rights. You may use an authorized agent; we may need to verify your request. If we deny a request, you may appeal by replying to our answer.

Because we don't run accounts, we may ask for your device's app-instance information (shown in the support email we reply with) to find records about you in our providers' systems.

4a. Regional information

We follow the standards of the EU GDPR for all players worldwide, and you can use the rights in section 4 wherever you live. In addition:

Brazil (LGPD): you may confirm whether we process your data, access, correct, anonymize, port or delete it, learn which entities we share it with, and revoke consent. Our contact for data subjects ("encarregado") is Joshua, joshua@minimumillion.com. You may also contact the ANPD.
Canada (PIPEDA, Quebec Law 25): we are accountable for your data as described here. You may access and correct it, withdraw consent, and complain to us or the Office of the Privacy Commissioner of Canada (or the CAI in Quebec).
Australia (Privacy Act 1988): you may access and correct your data and complain to us. If you're not satisfied with our answer, you can contact the OAIC. Some data is processed overseas by the providers listed in section 2.
Japan (APPI): data is provided to the third parties in section 2, some outside Japan (including the United States). You may request disclosure, correction, suspension of use, or deletion.
South Korea (PIPA): section 2 lists the items collected, purposes and recipients (including overseas transfer to Google, Meta, TikTok, RevenueCat and Apple, mainly in the United States) and section 7 lists retention periods. You may request access, correction, deletion or suspension of processing, and contact the PIPC or KISA.
India (DPDP Act 2023): you may access a summary of your data, correct or erase it, nominate another person to exercise your rights, and raise a grievance with us. If unresolved, you can contact the Data Protection Board of India.
Singapore (PDPA): you may access and correct your data and withdraw consent. Our data protection contact is listed in section 1.
Türkiye (KVKK), Switzerland (FADP), New Zealand (Privacy Act 2020), South Africa (POPIA): you have similar rights to access, correct and delete your data and to complain to your local authority.
Hong Kong and mainland China: the Game is not offered in Hong Kong or mainland China.

To use any of these rights, email joshua@minimumillion.com. We reply within 30 days (40 days at most under Hong Kong law). We may need to verify your request first.

5. Legal bases (EU/UK)

Consent (personalized ads, analytics storage and advertising measurement where consent is required); performance of our contract with you (running the Game, delivering and restoring purchases and subscriptions); legitimate interests (keeping the Game secure, fixing bugs, measuring performance and non-personalized ads where consent is not required).

6. Where data is processed

We are based in Hong Kong. Our service providers and partners (such as Google, Meta, TikTok, RevenueCat and Apple) may process data in the United States and other countries. Where required, transfers are protected by safeguards such as the European Commission's Standard Contractual Clauses or adequacy decisions.

7. How long we keep data

Game progress: on your device until you reset it or uninstall the Game.
Analytics data: up to 14 months in Google Analytics for Firebase, then deleted or aggregated.
Install and campaign data: as set by each partner, normally no longer than 24 months.
Purchase and subscription records: as long as needed to restore purchases and meet tax and legal obligations (normally up to 7 years).
Support emails: up to 2 years after your last message.

8. Security

All data the Game sends travels over encrypted connections (HTTPS/TLS). We limit access to the data our providers hold to people who need it to run the Game. No method of transmission or storage is 100% secure, but we take reasonable steps to protect your data. If a data breach affects you, we will notify you and the authorities where required by law.

9. Children and age

The Game is designed for players aged 13 and over and is not directed at children. When the Game starts for the first time, it asks your age range with a neutral question, and applies these protections:

Under 13 (kid-safe mode): no analytics are collected and no game events are sent; ads are requested as child-directed, in line with the U.S. Children's Online Privacy Protection Act (COPPA), and limited to content suitable for all ages; no data is shared with advertising measurement partners. Purchases go through Google Play or Apple, where parents can require approval for every purchase.
Under 16: personalized ads, advertising measurement and analytics storage are switched off, and ads are requested as "under the age of consent".
Under 18: only ads suitable for teenagers are requested.

We do not knowingly collect personal data from children under 13 (or the higher age of digital consent in your country) beyond what is technically needed to run the Game and show child-directed ads. If you believe a child's data was collected, contact us and we will delete it.

10. Changes

If we change this policy, we will update the effective date above and, for significant changes, show a notice in the Game before the change applies to you.

11. Contact

Minimum Illion Limited (Minillion Studios)
39/F, The Center, 99 Queen's Road Central, Hong Kong
Email: joshua@minimumillion.com