The Last EchoPrivacy Policy β The Last Echo
Effective date: 10 July 2026 Β·
Last updated: 10 July 2026
App: The Last Echo ("the Game", "we", "us")
Provider: runsIT (Canada)
Contact: info@runs-it.com
This policy applies to the Game on all platforms (Android, iOS, and any tvOS build). Where we collect more data on one platform than another, this policy describes the most inclusive case. It is kept in sync with our Google Play Data safety form and Apple App Privacy label.
1. Summary
The Last Echo is a single-player idle RPG with optional online features (leaderboards, chat, guilds, mail, and in-app purchases) and optional rewarded ads. We collect the minimum data needed to run those features. We do not sell your data, we do not run behavioral ad tracking by default, and we do not request your precise location, contacts, photos, or microphone/camera data. We do not collect your email unless you choose to link an account.
2. Data we collect
| Data | Why we collect it | Retention |
|---|---|---|
| Anonymous player ID (random UUID) | Identifies your save and account without using personal identifiers | Until account deletion |
| Chosen display name | Shown on leaderboards, chat, and guilds as DisplayName#xxxx |
Until account deletion |
| Session timestamps | Offline-progress calculation; basic service operation | Until account deletion |
| Save / game state | Stores your progress (encrypted at rest) | Until account deletion |
| Purchase transaction IDs | Validate in-app purchases and prevent fraud/duplicate grants | While the account exists; after deletion, unlinked records kept until 7 years from validation |
| Chat messages | Deliver in-game chat and enable moderation | 30-day rolling, then deleted |
| Leaderboard / ranking stats | Operate competitive leaderboards | Current season only |
| Linked account identifier (optional) | Only if you link email, Google, or Apple sign-in; Supabase Authentication stores the email address for sign-in, verification, recovery and account management; it is not stored only as a hash | Until you unlink or delete |
| Diagnostic / crash data | Fix crashes and bugs (device model, OS version, error details); not linked to your identity | Up to 90 days |
| Advertising data (only if you opt in) | If you choose to watch a rewarded ad, our ad partner may access device identifiers, IP-derived approximate location, diagnostics and ad-interaction data | Governed by the ad partner; off by default |
We do not collect: your precise location, contacts, photos, or microphone/camera data. Optional ad SDKs may process device identifiers and IP-derived approximate location when enabled. Ad personalisation is governed by your consent and platform settings.
Website advertising and cookies
This website uses Google AdSense. Google and its partners may use cookies, device identifiers, and information about visits to this and other websites to provide, measure, and personalise ads, subject to your region and consent choices. You can learn how Google uses information from sites that use its services at Google's partner-sites policy and manage advertising preferences at My Ad Center.
Advertising on this website is separate from optional rewarded advertising inside the Game. Declining personalised website advertising does not prevent access to the website or the Game.
3. How your data maps to App Store & Google Play categories
To keep our store disclosures accurate, here is how the data above maps to the platform privacy labels:
| Category | Collected? | Linked to you? | Used to track you? |
|---|---|---|---|
| Identifiers (anonymous player ID, display name, linked email) | Yes | Yes | No |
| Purchases (transaction IDs) | Yes | Yes | No |
| User content (chat messages) | Yes | Yes | No |
| Gameplay / app activity (progress, rankings, session times) | Yes | Yes | No |
| Diagnostics (crash & performance data) | Yes | No | No |
| Advertising data & device advertising ID | Only if you opt in | May be linked by device ID | Only if you opt in |
| Approximate location (IP-derived by optional ad partners) | When ads are enabled | Depends on partner | Depends on consent |
| Precise location, contacts, photos, health, browsing history, microphone, camera | No | β | β |
4. How we use data
We use the data above only to: run and save your game; provide optional online features (chat, leaderboards, guilds, mail); process and verify in-app purchases; deliver optional rewarded ads and grant their rewards; detect cheating and abuse; fix crashes and bugs; respond to support requests; and comply with legal obligations. We do not use your data for profiling, and we do not run behavioral ad tracking unless you opt in.
5. Legal bases (GDPR, where applicable)
- Performance of a contract β running the Game and the features you use.
- Legitimate interests β fraud/cheat prevention, security, crash diagnostics, and service integrity.
- Legal obligation β retaining purchase records for tax/accounting.
- Consent β any optional feature you opt into (e.g., linking an account or enabling personalised ads). You may withdraw consent at any time.
6. Who we share data with (processors & partners)
We share data only with service providers that help us run the Game, under contract. This includes third-party partners whose code (SDKs) we integrate into the app:
- Supabase β hosts the backend database, authentication, and real-time services (United States). Player data is isolated per account by row-level security.
- Apple App Store / Google Play β handle account sign-in (if you link one) and all payments. We never receive or store your full payment details. Purchase receipts are validated server-to-server.
- Apple App Attest / Google Play Integrity β device-integrity attestation used for anti-cheat. These return an attestation result; they are not used to track you.
- Unity LevelPlay (ironSource), with AdMob, Unity Ads, and ironSource as ad-network adapters β powers optional rewarded ads. The ad SDK only initialises after you choose to watch an ad. If you have not opted in to ad personalisation, ads are requested in non-personalised mode. These partners may process device identifiers, IP-derived approximate location, diagnostics and ad-interaction data subject to their own privacy policies.
We do not sell your personal information, and we do not share it with data brokers.
7. International transfers
Our backend is hosted in the United States by Supabase. If you access the Game from Canada, the EEA, the UK, or elsewhere, your data may be processed in the United States under appropriate safeguards (e.g., Standard Contractual Clauses where required).
8. Security
Saves are encrypted at rest (AES-256) and integrity-protected (HMAC-SHA256). All backend communication uses HTTPS and WSS with TLS encryption. We minimize the personal data we collect and apply access controls on the backend. No system is perfectly secure, but we take reasonable, industry-standard measures to protect your data.
9. Your rights and deletion requests
Request account or selected-data deletion, including deletion while keeping your account. Email info@runs-it.com; the request page lists steps, ownership verification, removed data and retention. You do not need the Game installed.
Requests are completed within 30 days after ownership verification. In the Game, use Settings β Account & Privacy β Delete Account. Account deletion removes your credentials, linked email, profile, cloud save, chat, mail, guild membership, rankings, sessions, raid participation and account-linked reward history. The in-Game action also removes this device's account saves and backups.
Purchase transaction identities, product/platform and validation dates are kept while the account exists. After deletion, unlinked records are retained until 7 years from validation for accounting and replay prevention, with the player-ID link removed. Unidentified aggregate statistics remain. Operational backups expire under the configured backend retention period and are not used to restore deleted accounts. We explain any legal exception when handling a request. We forward ad-partner requests or provide their deletion route.
A website request cannot erase files on your devices: use the in-Game control or clear app storage on each device. Uninstalling alone does not delete your server account. Selected-data deletion keeps your account and data outside your request; continued play may create new data.
You may also request access, correction, processing restrictions or consent withdrawal at info@runs-it.com. We do not discriminate against users exercising these rights.
10. Children's privacy
The Last Echo is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us data, contact info@runs-it.com and we will delete it.
11. In-app purchases, ads & randomized items
The Game offers optional in-app purchases of premium currency ("Gems") and contains randomized reward mechanics ("gacha"). Purchases are processed by Apple/Google. Rewarded ads are optional and never required for progression. The odds for randomized rewards are disclosed in-game and in our Terms of Service. See the Terms of Service for full details.
12. Changes to this policy
We may update this policy. Material changes will be announced in-Game or via the store listing, and the "Last updated" date above will change. Continued play after an update means you accept the revised policy.
13. Contact
runsIT (Canada)
Email: info@runs-it.com
A mailing address is available on request by email.