Privacy Policy

Last Updated: May 18, 2026 · Survival Studios · Plague Survival

1. Overview

Plague Survival is a multiplayer survival horror game developed and operated by Survival Studios. This Privacy Policy explains what data is collected during your use of the application, how it is used, which third-party services are involved, and what rights you have regarding your data. By installing or using Plague Survival, you agree to the practices described in this policy.

2. Information We Collect

2.1 Account and Identity Data

Your platform user identifier (Oculus/Meta User ID) used to identify your account
A unique internal player identifier assigned by our backend services (PlayFab ID)
Account creation date and last login timestamp
Whether your account was newly created during a session

2.2 Session and Authentication Data

Session tickets and authentication tokens generated at login — used to verify your identity during gameplay and discarded after the session
Session start and end timestamps
A hashed (SHA-256) representation of your device identifier — used for session integrity verification; the raw hardware identifier is never transmitted or stored
Build version of the application used during the session
Cryptographic attestation data confirming the integrity of the application build

2.3 Gameplay and Network Data

In-game position, movement, and interaction data required for server-authoritative multiplayer synchronisation
In-game statistics such as health values and score, validated server-side to ensure fair play
Network event data including connection quality and session activity
Session room or instance identifiers

2.4 Device and Technical Data

Device type, operating system version, and hardware configuration
Application version and build identifier
IP address — used for multiplayer routing, regional connection optimisation, and security purposes
User-agent string identifying the client software
Network stability indicators and connection quality metrics

2.5 Anti-Cheat and Security Data

Server-side validation results for movement, statistics, and network behaviour
Automated detection events and associated confidence scores used to identify potential rule violations
Moderation history including any warnings, strikes, or bans issued to an account
Evidence records associated with moderation actions, retained for appeal purposes
Audit logs of automated and manual moderation decisions

3. How We Use Information

Collected data is used strictly for the following operational purposes:

Authenticating your identity and verifying the integrity of the application at login
Enabling and synchronising multiplayer gameplay
Maintaining server-authoritative game state to ensure fair and consistent play
Detecting, investigating, and preventing cheating, abuse, and malicious activity
Managing account moderation including warnings, strikes, and bans
Diagnosing technical issues and improving application stability and performance
Complying with platform requirements and applicable law

We do not use your data for advertising, profiling, or any purpose unrelated to operating the game.

4. Third-Party Services

Plague Survival relies on the following third-party services to deliver core functionality. Each provider processes only the data necessary for their stated purpose and is subject to their own privacy policies. We have listed them here in the interest of full transparency.

Provider	Purpose	Data Involved	Privacy Policy
Meta / Oculus	Platform identity, application distribution, in-app purchases, and build attestation	Oculus User ID, platform entitlement data, device attestation tokens	meta.com/legal/privacy-policy
Microsoft PlayFab	Player account management, session authentication, ban enforcement, and server-side moderation actions via CloudScript	PlayFab Player ID, session tickets, ban records, violation reports	privacy.microsoft.com
Cloudflare	Backend API hosting (Cloudflare Workers), edge database (D1 / SQLite), key-value storage (KV), DDoS protection, SSL termination, and global content delivery	IP address, request metadata, authentication records, session state, moderation data, ban store entries	cloudflare.com/privacypolicy
Photon / Exit Games (Photon Fusion)	Real-time multiplayer networking in Server Mode — synchronises game state between connected players	Player connection data, in-game state (position, stats, interactions), session room identifiers, network quality metrics	photonengine.com/en-US/Photon/Gdpr

No third-party service listed above is permitted to use data originating from Plague Survival for advertising, analytics unrelated to service operation, or sale to other parties.

5. In-App Purchases and Payment Security

All in-app purchases are processed exclusively through the Meta Quest platform's official payment system. Survival Studios does not collect, process, store, or have access to any payment information including credit card numbers, billing addresses, or financial credentials of any kind.

The application receives only a confirmation of purchase entitlement (such as access rights or unlocked content) from the platform. All financial data is handled entirely by Meta and their payment processors under their own security and compliance standards.

6. Data Sharing

We do not sell personal data to any party. We do not share personal data with advertisers.

Data is shared only in the following limited circumstances:

With the third-party infrastructure providers listed in Section 4, as required to operate the game
With platform providers (Meta) as required by platform policy and app distribution agreements
Where required by applicable law, regulation, or valid legal process

7. Data Storage and Retention

Authentication and session records are retained for security and anti-cheat purposes. Moderation records including ban history and violation evidence are retained for the duration of the associated account's existence and for a reasonable period thereafter for appeal and audit purposes.

Pending authentication state created during the login process is automatically deleted upon session completion or expires automatically if the login process is not completed within a short time window.

Technical logs and diagnostic data are retained only as long as necessary for debugging and performance improvement, and are not linked to identifiable user accounts beyond what is necessary for that purpose.

8. Security

Plague Survival implements multiple layers of technical security measures including:

Cryptographic session integrity verification at every login using a custom token protocol (AWMS-VERIFY) employing SHA-256 key derivation, XOR encryption, and HMAC-SHA256 authentication
Server-authoritative game state validation — the server independently validates all player actions and statistics
TLS 1.3 encryption on all communications between the application and backend services
DDoS protection provided at the network level by Cloudflare
Automated abuse detection with confidence-scored violation reporting and multi-layer ban enforcement

No system connected to the internet can be guaranteed to be completely secure. In the event of a data security incident affecting your personal data, we will notify affected users in accordance with applicable law.

9. Children's Privacy

Plague Survival is rated for users aged 17 and older and is intended for a mature audience. We do not knowingly collect personal data from individuals under the age of 17. If you believe a minor has provided personal data through the application, please contact us using the details below and we will take appropriate steps to remove that data.

10. Your Rights

Depending on your location and applicable law, you may have the following rights regarding your personal data:

Access — request a copy of the data we hold about you
Deletion — request deletion of your personal data
Correction — request correction of inaccurate data
Restriction — request that we limit processing of your data in certain circumstances
Portability — request your data in a portable format where technically feasible

Note that certain data such as moderation records and ban history may be retained even following a deletion request where retention is necessary to enforce platform rules, prevent abuse, or comply with legal obligations.

To submit a request, use the contact information in Section 12.

11. Changes to This Policy

This Privacy Policy may be updated periodically to reflect changes in the application, services, or applicable law. All updates will be posted on this page with a revised "Last Updated" date at the top. Continued use of the application following a material update constitutes acceptance of the revised policy.

12. Contact

For privacy-related inquiries, data requests, or questions about this policy, contact:

Survival Studios
Email: taidenw@outlook.com