The Last EchoPrivacy Policy — The Last Echo
Effective date: 10 July 2026 ·
Last updated: 10 July 2026
App: The Last Echo ("the Game", "we", "us")
Provider: runsIT (Canada)
Contact: info@runs-it.com
This policy applies to the Game on all platforms (Android, iOS, and any tvOS build). Where we collect more data on one platform than another, this policy describes the most inclusive case. It is kept in sync with our Google Play Data safety form and Apple App Privacy label.
1. Summary
The Last Echo is a single-player idle RPG with optional online features (leaderboards, chat, guilds, mail, and in-app purchases) and optional rewarded ads. We collect the minimum data needed to run those features. We do not sell your data, we do not run behavioral ad tracking by default, and we do not collect your real name, precise location, contacts, photos, or microphone/camera data. We do not collect your email unless you choose to link an account.
2. Data we collect
| Data | Why we collect it | Retention |
|---|---|---|
| Anonymous player ID (random UUID) | Identifies your save and account without using personal identifiers | Until account deletion |
| Chosen display name | Shown on leaderboards, chat, and guilds as DisplayName#xxxx |
Until account deletion |
| Session timestamps | Offline-progress calculation; basic service operation | Until account deletion |
| Save / game state | Stores your progress (encrypted at rest) | Until account deletion |
| Purchase transaction IDs | Validate in-app purchases and prevent fraud/duplicate grants | 7 years (legal/tax retention) |
| Chat messages | Deliver in-game chat and enable moderation | 30-day rolling, then deleted |
| Leaderboard / ranking stats | Operate competitive leaderboards | Current season only |
| Linked account identifier (optional) | Only if you link email, Google, or Apple sign-in; the email is stored hashed, never in plaintext | Until you unlink or delete |
| Diagnostic / crash data | Fix crashes and bugs (device model, OS version, error details); not linked to your identity | Up to 90 days |
| Advertising data (only if you opt in) | If you choose to watch a rewarded ad and enable ad personalisation, our ad partner may access a device advertising identifier and ad-interaction data | Governed by the ad partner; off by default |
We do not collect: your real name, plaintext email, precise or coarse location, contacts, photos, or microphone/camera data. We do not use a device advertising identifier (IDFA/GAID) unless you opt in to personalised rewarded ads.
3. How your data maps to App Store & Google Play categories
To keep our store disclosures accurate, here is how the data above maps to the platform privacy labels:
| Category | Collected? | Linked to you? | Used to track you? |
|---|---|---|---|
| Identifiers (anonymous player ID, display name, hashed linked email) | Yes | Yes | No |
| Purchases (transaction IDs) | Yes | Yes | No |
| User content (chat messages) | Yes | Yes | No |
| Gameplay / app activity (progress, rankings, session times) | Yes | Yes | No |
| Diagnostics (crash & performance data) | Yes | No | No |
| Advertising data & device advertising ID | Only if you opt in | No | Only if you opt in |
| Location, contacts, photos, health, browsing history, microphone, camera | No | — | — |
4. How we use data
We use the data above only to: run and save your game; provide optional online features (chat, leaderboards, guilds, mail); process and verify in-app purchases; deliver optional rewarded ads and grant their rewards; detect cheating and abuse; fix crashes and bugs; respond to support requests; and comply with legal obligations. We do not use your data for profiling, and we do not run behavioral ad tracking unless you opt in.
5. Legal bases (GDPR, where applicable)
- Performance of a contract — running the Game and the features you use.
- Legitimate interests — fraud/cheat prevention, security, crash diagnostics, and service integrity.
- Legal obligation — retaining purchase records for tax/accounting.
- Consent — any optional feature you opt into (e.g., linking an account or enabling personalised ads). You may withdraw consent at any time.
6. Who we share data with (processors & partners)
We share data only with service providers that help us run the Game, under contract. This includes third-party partners whose code (SDKs) we integrate into the app:
- Supabase — hosts the backend database, authentication, and real-time services (United States). Player data is isolated per account by row-level security.
- Apple App Store / Google Play — handle account sign-in (if you link one) and all payments. We never receive or store your full payment details. Purchase receipts are validated server-to-server.
- Apple App Attest / Google Play Integrity — device-integrity attestation used for anti-cheat. These return an attestation result; they are not used to track you.
- Unity LevelPlay (ironSource), with AdMob, Unity Ads, and ironSource as ad-network adapters — powers optional rewarded ads. The ad SDK only initialises after you choose to watch an ad. If you have not opted in to ad personalisation, ads are requested in non-personalised mode. These partners may process a device advertising identifier and ad-interaction data subject to their own privacy policies.
We do not sell your personal information, and we do not share it with data brokers.
7. International transfers
Our backend is hosted in the United States by Supabase. If you access the Game from Canada, the EEA, the UK, or elsewhere, your data may be processed in the United States under appropriate safeguards (e.g., Standard Contractual Clauses where required).
8. Security
Saves are encrypted at rest (AES-256) and integrity-protected (HMAC-SHA256). All network communication uses TLS 1.3. We minimize the personal data we collect and apply access controls on the backend. No system is perfectly secure, but we take reasonable, industry-standard measures to protect your data.
9. Your rights
Depending on your region (Canada's PIPEDA, GDPR, UK GDPR, CCPA/CPRA, and others), you may have the right to:
- Access the data we hold about you;
- Delete your account and associated data — in-Game via Settings → Account → Delete Account, which anonymizes your data within 30 days;
- Correct inaccurate data (e.g., change your display name);
- Object to or restrict certain processing;
- Withdraw consent for any optional feature.
To exercise any right, use the in-Game deletion control or contact info@runs-it.com. We do not discriminate against you for exercising these rights. California residents: we do not "sell" or "share" personal information as those terms are defined under the CPRA. Canadian residents may also contact the Office of the Privacy Commissioner of Canada.
10. Children's privacy
The Last Echo is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us data, contact info@runs-it.com and we will delete it.
11. In-app purchases, ads & randomized items
The Game offers optional in-app purchases of premium currency ("Gems") and contains randomized reward mechanics ("gacha"). Purchases are processed by Apple/Google. Rewarded ads are optional and never required for progression. The odds for randomized rewards are disclosed in-game and in our Terms of Service. See the Terms of Service for full details.
12. Changes to this policy
We may update this policy. Material changes will be announced in-Game or via the store listing, and the "Last updated" date above will change. Continued play after an update means you accept the revised policy.
13. Contact
runsIT (Canada)
Email: info@runs-it.com
A mailing address is available on request by email.