Controller and contact
The controller for data relating to LastPackage is Przemysław Majak, Poland, who develops the game under the name HalfSpriteStudio. For privacy and support, contact halfspritestudio@gmail.com. No player account is required.
Game progress and settings
The game stores completed and unlocked levels, the state of an ongoing puzzle, tutorial progress, coin balances, reward receipts and settings such as language locally on your device. These records allow the game to work and resume your progress. They are not automatically uploaded to a developer-operated server. Selected progress and coin events may be sent through the optional analytics described below. System backup and restoration may depend on your Android and device-account settings.
The current shop uses coins earned in gameplay; we do not process real-money purchases. The game does not request payment details.
Advertising and Google data
The game integrates Google AdMob (Google Mobile Ads SDK) and Google User Messaging Platform (UMP) for ads and privacy choices. The current alpha uses test ads. Watching a rewarded ad is optional; declining it does not block normal level progression.
Google SDKs may process and share your IP address, approximate location inferred from IP, device or account identifiers including the advertising ID when available, app launch and app/ad interaction information, and application/SDK diagnostics. Purposes include ad delivery and measurement, diagnostics, security and fraud prevention. We do not obtain GPS location or request precise-location permission.
The current game configuration disables ad personalization. Non-personalized and test ads do not mean that no technical data is processed. Gameplay analytics is separately provided by GameAnalytics and crash reports by Firebase Crashlytics. Firebase Analytics is not enabled. Advertising statistics and diagnostics remain part of AdMob operation.
Your advertising choices
Where required, UMP displays a form allowing you to accept, decline or customize data choices. You can revisit your choices using “Ad privacy” when this button is made available in the game according to UMP requirements. Withdrawing consent does not affect the lawfulness of processing before withdrawal.
Declining consent does not block core gameplay. Depending on your choices and availability, it may affect ads and their optional additional rewards. Android privacy settings also provide advertising-ID controls. Changing these controls does not automatically erase all data previously processed by providers.
Optional GameAnalytics
After you separately enable analytics, the game sends events to GameAnalytics to assess puzzle difficulty, the tutorial and shop, the coin economy, ads and player returns. Events include level starts, completions and resumes, restarts and explicit exits, active attempt time and counts of Undo and Recover uses. Shop events describe introduction views, opening or postponing the introduction, item previews, insufficient funds and successful purchases and equipment changes. Economy events describe reward amounts and sources or cosmetic spending. Ad events describe availability, failures, opening, closing, reward confirmation and saving; save failures use limited codes.
The SDK receives pseudonymous user, installation and session identifiers, device, operating-system and game-version details, and your IP address. It links sessions to measure retention: how many players return on subsequent days. We also send limited system-language and game-language categories to plan translations. Advertising-ID tracking is disabled in our GameAnalytics configuration. We do not send this service your full save, profile name, individual parcel moves or rotations, or screen recordings.
Our geographic analysis uses the country inferred by the provider from IP. We do not obtain GPS or your home address. The provider may also technically infer an approximate region or city from IP; the provider documents linked below also describe its processing.
Optional Firebase Crashlytics reports
After you separately enable crash reports, we use Firebase Crashlytics (Google) to diagnose errors and stability. Reports may include stack traces, technical crash data, installation identifiers, device model, operating system, app version and operational information. We add the build version, game phase and level number. Our custom diagnostic context does not include your balance, profile name or save contents. For managed game-code exceptions handled by our integration, we use a fixed error description and stack trace instead of the exception message.
The SDK may store pending reports locally. Consent covers sending pending and future reports. Automatic uploading is disabled by default and we request uploads after consent. Enabling this feature does not enable Firebase Analytics.
To handle data-rights requests, we locally save the GameAnalytics identifiers assigned by the service after consent. After diagnostic consent, we assign a separate random installation code and attach it to subsequent reports as the Crashlytics user identifier. It is not used in GameAnalytics or ads and contains no name or email. It does not create an account. Older reports without this code and earlier installations may require separate identification.
Changing analytics and diagnostics consent
You can separately enable or disable analytics and crash reports in game settings. Both features are optional and off by default. Declining does not limit gameplay. Withdrawal stops new upload requests through the relevant integration; it does not recall data already delivered or transmissions already started. When diagnostic consent is withdrawn, we ask the SDK to delete pending reports. Enabling a feature again after withdrawal may require restarting the game. You can contact the controller to request deletion of previously sent data.
These decisions are independent of the Google ad-privacy form. Disabling GameAnalytics or Crashlytics does not disable technical data processing associated with the advertising SDK.
Messages and support requests
If you email the developer, we process your sender address, message and any attachments you choose to provide to respond, offer technical support and handle your request. Do not send passwords, payment details or other information that is unnecessary for your request. The game does not retrieve your contacts, photos or private Google account details to determine your age.
Purposes and legal bases
For personal data subject to GDPR, we use the following bases:
Operating the game and saving progress locally: performance of the agreement to use the game — GDPR Article 6(1)(b), insofar as the records include personal data. Storage necessary to provide a requested function falls under the applicable terminal-equipment exception.
Optional GameAnalytics and Crashlytics uploads: separate consents — GDPR Article 6(1)(a). Consent also covers optional storage or access to information on your device where required by Article 399 of the Polish Electronic Communications Law or the applicable national implementation of the ePrivacy Directive.
Ads: consent where required for the processing or device access concerned, with choices handled through Google UMP. Data necessary for transmission or a function expressly requested by you may fall under an applicable exception. Choosing non-personalised ads does not replace required consent.
Contact and security: legitimate interests in answering messages, handling requests, protecting services and establishing, exercising or defending claims — GDPR Article 6(1)(f). Handling data-rights requests and demonstrating compliance with GDPR obligations rely on legal obligations — Article 6(1)(c) together with the relevant GDPR provisions.
Legitimate interests do not replace required consent. We do not use these statistics for solely automated decisions producing legal or similarly significant effects on a player.
Providers and data recipients
GameAnalytics ApS and its affiliates provide analytics, processing player data on our behalf under a data-processing addendum. Google generally processes Firebase Crashlytics data on our behalf; its role in advertising services depends on the purpose and applicable service terms. Providers process the information described in the relevant sections and linked documents below.
Google processes technical data associated with advertising and consent forms, together with parties identified in Google information and, where applicable, the consent form’s partner list. Under Google’s privacy policy, Google Ireland Limited is the relevant Google controller for the EEA and Switzerland; other regions are covered by the relevant Google entities identified by Google. The consent form and provider policies explain their roles and practices.
Email sent to halfspritestudio@gmail.com is handled through Gmail. This policy website is hosted using Cloudflare Pages. Email and hosting providers may process technical information needed to deliver messages, serve the page and protect their services. We do not add ads, analytics tools, external fonts or tracking scripts to the policy page.
We do not sell local game saves or support correspondence. This does not mean the advertising SDK never shares data for the purposes described above. Public authorities or advisers may receive information where required by law or necessary to protect legal claims.
Transfers outside the EEA
Google, GameAnalytics, email and hosting providers may process information outside the European Economic Area, including in the United States. Appropriate mechanisms depend on the provider and transfer and may include an applicable adequacy decision or standard contractual clauses and supplementary safeguards. Provider documents linked below explain their arrangements and how to obtain information about safeguards. We do not claim all data remains in Poland or the EU.
How long data is kept
Local saves remain on the device until you clear app data or uninstall the app, subject to any system backups. We keep support correspondence for as long as needed to handle the matter and afterwards only as necessary for legal obligations or establishing, exercising or defending claims under applicable limitation periods.
Advertising and diagnostic information, consent choices and provider logs may have different retention periods depending on the purpose and service. Google describes its retention periods and criteria in its data-retention policy. The developer cannot directly erase all data held in independent Google or hosting systems.
Our local attempt-measurement journals are limited to 256 files; when creating further files we remove files older than 30 days and excess files. This is not a deletion deadline for provider systems. Under the current GameAnalytics schedule: raw and annotated data — 1 month; Player Warehouse — 1 year; Player Lookups used to calculate retention — 18 months. Its data-processing addendum describes these categories and periods.
According to Google, Crashlytics keeps crash traces, extracted minidump data and associated identifiers for 90 days before starting removal from live and backup systems. Anonymous statistics may be retained longer if they no longer identify a person.
After analytics is declined or consent is withdrawn, the game removes its own local attempt journals without erasing game progress or coins. If removal fails, cleanup is retried when the module next starts without valid consent. This does not erase data previously sent to services.
Local identifiers for rights handling are kept for up to 24 months after their last use by the integration; expired entries are removed when this data is next processed. They remain available after uploads are disabled so earlier data can be located on request. They are not used for further analytics. Clearing app data removes these local codes.
Your rights and deleting data
Subject to GDPR conditions, you can request access, rectification, erasure and restriction of processing. Where the legal conditions apply, you can obtain portability and object to processing based on legitimate interests. You can withdraw consent at any time in game settings, without affecting the lawfulness of previous processing.
Email halfspritestudio@gmail.com and indicate whether your request concerns analytics, diagnostics, ads or correspondence. We respond without undue delay, normally within one month. If a lawful extension is needed, we explain the reason within the first month.
The game does not automatically link SDK identifiers to your email address. Locating a particular record may require the identifier used by the relevant service or other proportionate information. We do not routinely require identity documents or additional identity data just to play. If we cannot identify your data, we will explain this. Where necessary, we seek assistance from providers processing data on our behalf.
Disabling a feature is not technical confirmation that server data has been erased. Following withdrawal, we assess and carry out erasure of consent-based data that we can associate with the user, unless a separate legal duty requires retention. You can also directly request erasure.
You can erase local progress by clearing app data in Android; this loses progress and coins. Uninstalling does not automatically erase information already sent to providers. System backups are managed through Android settings.
You can complain to the President of the Polish Personal Data Protection Office (uodo.gov.pl) or your local supervisory authority. Where a provider acts as an independent controller, its policy also lists relevant contacts and tools.
Choose “My data” in settings to copy a request or prepare an email with saved identifiers. Opening this screen does not start SDKs. Preparing a message does not automatically send it or confirm erasure. If you send the email, we process your sender address and included identifiers to handle your request. Previously sent service data requires action by the controller and provider.
Data security
Communication with analytics, diagnostics and advertising services uses encrypted connections. Game saves and settings are kept in app storage, also protected by Android. Service dashboards are intended for people authorised to operate the game. We do not publish player identifiers or crash reports. No storage or transmission method can guarantee complete security.
Age and the current alpha scope
The current alpha is intended for testers aged 16 and over. We do not direct this version at children and have not implemented parental consent. The game does not collect dates of birth or private Google-account data to check age. If we learn that information about someone below this age was provided without a valid basis, we will investigate and take steps to erase identifiable records. Contact: halfspritestudio@gmail.com.
Changes to this policy
This policy may change as features or providers change. The date at the top identifies the current version. Before adding new processing purposes or new providers, we will update the information and obtain new consent where required. This policy does not replace the choices provided by the UMP form.