Privacy and cookies

The short version: game stats come from the server's save, names stay hidden unless you opt in, sign-in uses one cookie, and Google Analytics counts page views unless you switch it off below.

Who runs this site

ZA-Z is a community Project Zomboid server run by one person in Johannesburg, South Africa, as a hobby. This site is the responsible party under the Protection of Personal Information Act (POPIA). Contact: zaz@barnesand.co, or an admin on the ZAGA Discord.

Game data

The site reads the game server's save every two hours: characters, skills, kills, deaths, safehouses, and the Steam ID and account name behind each. Public pages show a player as "Survivor #n" until that player opts in on My survivor. Coordinates and Steam IDs are never shown publicly. Opting out again hides the name at once.

Signing in

Sign in through Steam (the site receives your Steam ID and nothing else) or with your server account name and password. The password is checked against the game server's own hash and is never stored or logged by the site. A signed-in browser holds one cookie, zaz_session, for 30 days or until you sign out. It is needed for sign-in to work and carries no tracking. A vote in the mod poll is stored against your Steam ID.

Analytics

The site uses Google Analytics 4, loaded through Google Tag Manager, to see which pages get used and roughly where visitors come from. It records pages viewed, referrer, browser and device type, and an approximate location (country and city) worked out from your IP address, which Google does not store. It sets the cookies _ga and _ga_* (a random visitor number, kept up to two years). It is not linked to your Steam ID, game account or sign-in. There are no ads on this site, and advertising features, ad personalisation and Google signals are switched off.

The legal basis is legitimate interest (POPIA section 11(1)(f)): knowing what is used keeps a free site worth running. You can object at any time, no reason needed:

Turn analytics off Checking this browser.

A browser that sends the Global Privacy Control signal is treated as opted out. Visitors from the European Economic Area, the United Kingdom and Switzerland are never sent the analytics tag at all.

Who receives it

Google (analytics) and Vercel (hosting and the site's data store) process data on the site's behalf, on servers outside South Africa, mainly in the United States and the European Union. Both are bound by their published data processing terms, which is the basis for the transfer under POPIA section 72. Nothing is sold or shared with anyone else. Google keeps visit-level analytics data for up to 14 months.

Your rights

You can ask what the site holds about you, have it corrected or deleted, and object to its use. Email zaz@barnesand.co or ask on Discord. If the answer does not satisfy you, you can complain to the Information Regulator of South Africa.

Last updated 21 September 2026.