THE LAST RUN — LEGAL

Privacy Policy

Last updated: 9 October 2026 · Effective: 9 October 2026

The Last Run is a mobile game published by Navaye, a sole proprietorship based in Gwalior, Madhya Pradesh, India ("Navaye", "we", "us", "our"). This policy explains what personal data the game and its pages on this website handle, why, who receives it, where it is stored, how long it is kept, and the rights you have over it.

It is written to comply with India’s Digital Personal Data Protection Act, 2023 ("DPDPA") and the Information Technology Act, 2000 and, for players they protect, the EU and UK General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"). It forms part of, and is governed by, the The Last Run Terms of Service. If you do not agree with this policy, do not play the game.

IN SHORT

There is no account to create. On first launch the game makes an anonymous profile, known to us only by a random number. We never ask you to type a name, email address or phone number.
You can link that profile to Google Play Games so it follows you to a new phone. We store your Play Games player ID and display name, never your email. Apple Game Center will work the same way when the iOS version ships.
Signed-in players appear on a public leaderboard with their platform display name and best distances. Runs played as a guest are never sent on their own, and Delete my data removes your name and scores from the board at once. See "Leaderboard scores".
Our servers hold your Cans, crates and items, a record of what you bought, opened and used, and the distance and time of runs in which you found a crate.
Cans are bought through Google Play and processed for us by RevenueCat. We never see your card or other payment details.
From version 0.4.0 the game shows ads through Google AdMob: a banner, an optional ad you can watch to keep running, and an occasional ad between runs. The first run of a new install has none, and where the law requires it Google asks for your consent first. See "Ads and security checks".
The game also runs Talsec’s freeRASP security checks from the first launch, to spot tampered copies and abuse. They send anonymous diagnostics, including an approximate location worked out from your IP address, to Talsec. We run no analytics or crash-reporting service of our own.
Settings → Delete my data erases your profile from our servers and everything the game saved on your phone, straight away. Each Play Games or Game Center account has its own profile, and Delete my data deletes only the profile of the account the game is signed in to; sign in with another account to delete its profile too. You can also ask by email: see navaye.com/the-last-run/delete-account.

This box is a plain-language guide only. The numbered sections below are the terms that actually apply.

1.Scope of this policy

This policy applies to The Last Run mobile game on Android (and on iOS once it is released) and to its pages on this website, including the account-deletion page.

It does not apply to Google Play, Google Play Games, Google AdMob, the Apple App Store, Apple Game Center, or any other service you reach from the game. Those services are run by their own providers under their own privacy policies. Talsec’s security checks are described below, and Talsec’s own data policy applies to what it receives.

2.Who is responsible for your data

Navaye decides what personal data the game handles and why. Under the DPDPA Navaye is the Data Fiduciary, and under the GDPR Navaye is the controller, for everything described in this policy.

Google and Apple act as independent controllers for their stores, their payment systems, and Google Play Games and Apple Game Center. Google also acts as an independent controller for the ads it shows in the game through AdMob. What they collect when you use those services is governed by their policies, not this one.

3.Personal data we handle

We handle only what the game needs to work. The categories below are complete as of the date of this policy.

Anonymous player profile. On first launch the game silently signs in to our backend with an anonymous session, and our server gives you a random player ID. There is no sign-up screen, and no name, email address, phone number or password is collected. The session consists of an anonymous user record held by our backend provider and the access and refresh tokens your phone uses to prove it is you. The first eight characters of your player ID are shown at the bottom of Settings (for example "ID: bc30-4876") so you can quote it to us.
Google Play Games link (optional). If your phone is signed in to Google Play Games, the game links your profile to it in the background; you can also sign in from Settings or from the sign-in offer shown once after your first run. Google gives the game a one-time code, which our server exchanges with Google to confirm your Play Games player ID and to read your Play Games display name. We store the player ID with your profile, and nothing else from your Google account except that display name. We keep your Play Games display name with your profile and show it, with your best distances, on the public leaderboard (see "Leaderboard scores" below). We refresh it each time the game checks your sign-in, so a change you make in Play Games follows, and it is still passed to RevenueCat as described under "Purchases". Each time you sign in we also note your country (a two-letter code such as IN), worked out from the IP address of that request or, if that is not available, from your phone’s region setting, and keep it with your profile so that we can later offer leaderboards by country. We do not keep the IP address. Signing in is required before you can buy Cans, so a paid stash can always be recovered.
Apple Game Center link (iOS, when released). The same idea on iPhone: the game sends us Apple’s signed proof of your Game Center player ID, our server checks Apple’s signature, and we store the player ID with your profile. Your Game Center display name is sent with that proof. We keep your Game Center display name with your profile and show it, with your best distances, on the public leaderboard. We refresh it each time the game checks your sign-in, and it is still passed to RevenueCat in the same way. Your country is noted at each sign-in in the same way as for Play Games.
Wallet and inventory. Your balance of Cans, and the crates (Supply Crate, Treasure Chest, Briefcase) and items you hold.
Economy ledger. A record of each change to your wallet or inventory: buying crates or items with Cans, opening a crate and what it gave, using an item, a refunded purchase, and linking, restoring or merging profiles (the ledger names the platform only, never your platform player ID), each with a time.
Run reports. When you find a crate in a run, the game sends that run’s random ID, the distance you covered, the time you survived and the crates you found, and we store what we accepted. Runs in which you found no crate are not sent.
Leaderboard scores. Only while you are signed in to Play Games or Game Center, each finished run sends its random ID, the distance you covered, the time you survived, whether a Continue was used and when it finished. We keep your best clean run and your best Second Wind run, overall and for each week (Monday 00:00 UTC). Runs played as a guest are never sent on their own: if you sign in to an account that has no scores yet, only the two best distances saved on this phone are sent, once, and become that account’s bests.
Daily find counts. How many crates of each kind your profile has found on each day, used to apply the daily cap.
Purchase records. For each Cans purchase: the store’s transaction (order) number, the store, the product, the Cans credited, its environment (live or store sandbox), its status, the purchase time and, if refunded, the refund time.
Technical data. Whenever the game talks to our servers, they and our providers receive your IP address and basic request information, such as the app’s user agent. Our backend provider records these with sign-in sessions and in its security logs.
Advertising data (Google AdMob, version 0.4.0 and later). Once ads are switched on, Google’s ad software in the game collects and shares with Google your IP address (which may be used to estimate the general location of your phone), how you interact with ads and the app (app launch, taps and video views), diagnostic information (app launch time, hang rate and energy usage), and device and account identifiers: your Android advertising ID, an app set ID and, if applicable, other identifiers related to signed-in accounts on the phone. Google describes this on its Google Play data disclosure page. This data goes to Google, not to our servers.
Security diagnostics (Talsec freeRASP, version 0.4.0 and later). From the first launch the game runs security checks from Talsec. They send anonymous diagnostic data off your phone: information about the integrity of the app and the operating system (for example rooting, running in an emulator or use of a hooking framework), a device model and an anonymous identifier for this app instance, and your IP address, from which Talsec works out an approximate location (country, region and city) and network operator for fraud prevention and abuse detection. Talsec describes this in its user data policies. The game does not give Talsec your player ID, name or email address.
Support correspondence. If you email us, your email address, your message and anything you send with it.

Kept only on your phone. Your settings (volume levels, vibration, reduce motion and swipe sensitivity), your best distances and run count (for a signed-in player the best distances are also kept on our servers, see "Leaderboard scores"), how many times you have launched the game (so that the title-screen banner first appears after the fifth launch), whether you have seen the intro and the sign-in offer, your ad choices (stored by Google’s consent form), the last bag you packed, a cached copy of your wallet and inventory, a queue of actions not yet sent, and your sign-in session (in an encrypted file). This lets you pack and use items offline. Only the queued actions (items used and crates found) are sent to our servers, the next time you are online.

4.What we do not collect

Your real name, email address, phone number, date of birth, or any government identity number. The only name we hold is the Play Games or Game Center display name of the account you sign in with. (If you email us, we have the email address you write from.)
Your precise location. The game does not ask for location access. Google’s ad software and Talsec’s security checks each work out an approximate location from your IP address, as described under "Ads and security checks"; we do not receive it.
Your contacts, photos, files, camera or microphone.
Card numbers, UPI IDs, bank details or any payment credential. Payment happens entirely inside Google Play (or the App Store); we never see or receive your payment details.
Your advertising ID on our servers. The game’s ad software on your phone uses your Android advertising ID, but we never receive it, and you can reset or delete it in Android Settings → Privacy → Ads. We run no analytics or crash-reporting service of our own and do not build a profile of you across other apps or websites.

We do not sell or rent personal data, and we do not use it to train machine-learning models. The advertising and security data described under "Ads and security checks" goes to Google and Talsec, not through us.

5.Why we handle it, and on what basis

Under the DPDPA we process personal data on the basis of your consent, given when you start playing, or where the Act permits a legitimate use such as data you have provided voluntarily for that purpose. Under the GDPR the legal bases are as stated below.

To run the game and keep your stash: to create your profile, hold your Cans, crates and items on our servers, open crates and apply item use. GDPR basis: performance of our contract with you (the Terms).
To link, restore and merge profiles: so a new phone gets your stash back. Basis: performance of contract, at your request.
To show the leaderboard: for players who take part by signing in, to rank your best distances against other players and show your display name beside them. Basis: your consent, given by signing in to Play Games or Game Center in the game; under the GDPR, performance of contract, at your request.
To sell Cans and handle refunds: to credit a purchase once, and to remove Cans when a store refunds one. Basis: performance of contract, and legal obligation for the records accounting and tax law require us to keep.
To keep the game fair and secure: to check run reports against the run’s distance and time, enforce the daily crate cap, stop the same action being applied twice, and protect our servers from abuse. Basis: our legitimate interests in a fair economy and a secure service, which we have weighed against your interests; under the DPDPA, a legitimate use for preventing fraud.
To show ads: to pay for the game, Google AdMob shows ads and, for that, collects the data described under "Ads and security checks". Where the law requires your consent (for example in the EEA, the UK and some US states) Google’s consent form asks for it before ads start, and the GDPR basis is that consent. Elsewhere the basis is our legitimate interest in funding the game.
To detect tampering and abuse: Talsec’s security checks tell the game when it is running in a tampered copy, under a hooking tool, or in another unsafe setting, so it can refuse to start or pause paid actions, and they protect against fraud and bots. Basis: our legitimate interests in a fair economy and a secure service; under the DPDPA, a legitimate use for preventing fraud.
To answer you: support, data requests and grievances. Basis: legitimate interests, and legal obligation where a law requires us to respond.
To meet legal obligations: to respond to lawful requests and keep records a law requires.

Crate results are drawn at random by our server from the published odds; they are not tailored to you. Run reports are accepted or rejected automatically by fixed plausibility rules, which only decide whether a reported crate is credited. We make no automated decision that has legal or similarly significant effects on you, and we do no profiling ourselves. Google decides which ads you see, using the data described under "Ads and security checks". The one automatic decision the game makes about a device is a security check: a positive finding of tampering or hooking stops the game from starting, and a finding of an unofficial install source, a debugger or an emulator pauses purchases and crate opening on that device. Nothing is stored against your profile because of it.

7.Purchases

Cans are sold as in-app purchases through Google Play (and, once the iOS version ships, the Apple App Store). The store takes your payment under its own terms and privacy policy.

We use RevenueCat to process purchases. The game starts RevenueCat’s software when it launches, so the Shop can show prices in your local currency. RevenueCat receives your random player ID, which it uses as its customer ID, together with technical information its software collects from the app, such as device model, operating system, app version and store country, and the store’s purchase details when you buy. Once your profile is linked to Google Play Games or Apple Game Center, our server also gives RevenueCat your display name there, which of the two you linked, the app version, the platform (Android or iOS), your country as noted at sign-in, and the short form of your player ID shown in Settings (for example "ID: bc30-4876"), so we can find your purchases when you contact us. Our server receives each purchase from RevenueCat (and checks it with RevenueCat right after you buy) and credits the Cans once.

If the store refunds a purchase, RevenueCat tells our server and we remove the Cans that purchase added, up to the Cans your profile still holds.

9.Where your data is stored and processed

Our database is hosted by Supabase on cloud servers in Tokyo, Japan. RevenueCat is based in the United States, Google and Apple operate globally, and Talsec processes the security diagnostics on its own systems. Your personal data is therefore stored and processed outside India and, if you live in the EU or UK, outside your country.

The DPDPA permits such transfers except to countries the Central Government restricts by notification; we do not transfer personal data to any restricted territory. For players in the EU and UK, Japan is covered by an adequacy decision, and transfers to our other providers rely on their data processing terms, including the European Commission’s Standard Contractual Clauses and the UK equivalent, or another lawful transfer mechanism. You can ask us for details of these safeguards.

If we move our hosting to another region, we will update this section.

10.How we protect it

We take reasonable security safeguards, including:

Encryption of all data in transit (TLS), and encryption at rest by our hosting provider.
Row-level security in the database: a session can read only its own profile’s rows, and it cannot write to any table directly.
Every change to Cans, crates or items goes through server functions that check it. Prices, crate odds and crate results are set by the server, never by the phone.
Platform links are verified by our server with Google or Apple; the game can never just tell us an ID.
Purchase notifications from RevenueCat are authenticated, and each store transaction can credit Cans only once.
Our server functions log outcomes only, never your player ID, platform ID or tokens.
Your sign-in session is stored on your phone in an encrypted file.

No system is perfectly secure. Anyone with access to your unlocked phone can play as you, and anyone who controls your Play Games or Game Center account can restore your profile on another phone.

11.If there is a data breach

If a personal data breach occurs, we will notify the Data Protection Board of India and affected players in the form and within the time the DPDPA and rules made under it require, and, where the GDPR applies, the competent supervisory authority within 72 hours where required. Notice to you will describe, as far as we know it, what happened, its likely consequences, what we have done and what you can do to protect yourself.

Because we hold no contact details for most players, notice to you may be given in the game or on this website.

12.How long we keep it

Your profile, wallet, inventory, ledger, run reports, daily counts and platform link: for as long as the profile exists. Delete my data removes them at once.
Your display name and leaderboard scores: kept with your profile until you use Delete my data (or the profile is deleted), which removes them from the leaderboard at once.
Abandoned profiles: a weekly job deletes, together with its sign-in record, every profile that was never linked to Play Games or Game Center and either (a) is more than 90 days old, has had no activity on our servers in the last 90 days and holds no Cans and no items, or (b) has had no activity on our servers for 2 years, even if it still holds Cans or items. A profile linked to Play Games or Game Center is kept until it is deleted, so it can always be restored.
RevenueCat customer records: when you sign in and the game moves you to the profile already linked to your Play Games or Game Center account, the profile it replaces is deleted and its RevenueCat customer record follows, normally within minutes. The same happens to the record of a profile deleted by the weekly job above, and Delete my data deletes the record at once. A record that holds a purchase is not deleted by these automatic steps.
Purchase records: kept after a profile is deleted, with the link to the profile removed, for as long as accounting and tax law requires, currently up to eight financial years in India. These are financial records, not profile data, but the store order number in them could still be matched to your order in the store.
Backups and logs: deleted data can persist in our hosting provider’s encrypted backups and security logs for a limited period, after which it is overwritten in the normal rotation. Backups are never used to restore a profile that was deliberately deleted.
Advertising and security data held by Google and Talsec: we hold none of it on our servers. How long Google and Talsec keep it is set by their own policies, linked under "Who we share data with". Resetting your Android advertising ID cuts the link between past ad data and your phone.
Support correspondence: up to 24 months from the last message.
On your phone: until you delete it. Delete my data clears everything the game saved on the phone: your settings, best distance and run count, the last bag, the cached wallet and inventory, the queue and the sign-in session. Uninstalling the game or clearing its storage also removes it.

Where we must keep something to meet a legal obligation, or to establish, exercise or defend a legal claim, we keep only that, and only for as long as the obligation or claim lasts.

13.Your rights

Everyone. Under the DPDPA you have the right to:

Access: a summary of the personal data we hold about you, how it is processed, and who it has been shared with.
Correction and completion of inaccurate or incomplete data.
Erasure of your personal data, unless a law requires us to keep it.
Grievance redressal: a readily available way to complain to us, and escalation to the Data Protection Board of India if you are not satisfied.
Nomination of another person to exercise these rights for you in the event of your death or incapacity.

EU and UK players. Under the GDPR you also have the right to restrict processing, to data portability (a copy of the data you gave us in a machine-readable format), to object to processing based on our legitimate interests, and to withdraw consent at any time. You may complain to the data protection supervisory authority where you live or work (in the UK, the Information Commissioner’s Office).

California residents. Under the CCPA you have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and not to be discriminated against for using these rights. We do not sell your personal information for money, and we do not use sensitive personal information. The ads in the game are shown by Google AdMob, and the advertising data it collects (identifiers, IP address and interactions, see "Ads and security checks") may count as "sharing" for cross-context behavioural advertising under the CCPA. Where Google’s consent form applies to you as a resident of a US state, it offers an opt-out, which you can reach again at any time from Settings → Privacy options. You can also reset or delete your Android advertising ID in Android Settings → Privacy → Ads. The categories we collect are those listed in "Personal data we handle", from the sources and for the purposes described above. You may use an authorised agent.

How to exercise them. The quickest way to erase your data is Settings → Delete my data in the game. For anything else, email [email protected]. We answer within one month, or tell you within that month why we need longer.

Proving it is you. We know you only by a random player ID, so please quote the short player ID shown at the bottom of Settings (for example "ID: bc30-4876"), or the Google Play order number of a Cans purchase. We verify every request against our records before acting on it. See navaye.com/the-last-run/delete-account. We may decline requests that are manifestly unfounded, excessive or repetitive, and we will tell you why.

Your duties. The DPDPA also requires you not to impersonate anyone when providing data, not to suppress material information, and not to file false or frivolous complaints.

14.Grievance redressal

We have appointed a Grievance Officer as required by the DPDPA and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

Grievance Officer
Navaye (sole proprietorship)
Gwalior, Madhya Pradesh, India
Email: [email protected]

Write to that address with what happened, what you want done, and anything that ties you to your profile (see "Proving it is you"). We will acknowledge your complaint within 24 hours and resolve it within 15 days of receipt, or tell you why we need longer.

If you are not satisfied with our response, you may complain to the Data Protection Board of India established under the DPDPA, or to your local supervisory authority if the GDPR applies to you.

15.Children

The Last Run is a horror game and is not directed at children. You must be at least 13 years old to play, or older where the law of your country sets a higher age for consenting to the processing of your data online (up to 16 in parts of the European Economic Area).

If you are under 18, or under the age of majority where you live, you may play only with the permission of a parent or lawful guardian, who must agree to the Terms and this policy for you and must make or approve any purchase.

We do not knowingly collect personal data from children under the minimum age. The game tells Google’s ad software that it is not directed at children and limits ads to content Google rates suitable for teens (maximum ad content rating "T"); we do no behavioural monitoring of our own. If we learn that a profile belongs to a child under the minimum age, or under 18 without a parent’s or guardian’s consent where the law requires it, we will delete it. If you believe this has happened, email [email protected].

16.Ads and security checks

This section applies to version 0.4.0 of the game and later. Earlier versions contain neither.

Ads (Google AdMob). The game shows ads through Google AdMob only, with no mediation partners. There are three kinds: a banner on the results screen and, from your sixth launch, on the title screen; an ad you can choose to watch once per run to get back up after dying; and an occasional ad between runs. No ad loads or shows while you are running, except the one you chose to watch. The first run on a new install has no ads. After it, where the law requires consent, a short notice and Google’s consent form come first, and no ad is requested until you have answered. Where no consent is required, ads start after the first run without a form. Settings → Privacy options reopens Google’s form where it applies to you.

Google’s ad software in the game collects and shares the following with Google for advertising, analytics and fraud prevention, and encrypts all of it in transit with TLS (per Google’s page, last updated 5 October 2026):

your IP address, which may be used to estimate the general location of your phone;
how you interact with ads and the app, such as app launch, taps and video views;
diagnostic information about the performance of the app and the ad software, such as app launch time, hang rate and energy usage;
device and account identifiers: your Android advertising ID, an app set ID and, if applicable, other identifiers related to signed-in accounts on the phone.

Collecting the advertising ID is optional: you can reset or delete it in Android Settings → Privacy → Ads. The game asks Google for ads suitable for a 13+ audience and does not treat the game as directed to children. We receive no part of this data and pass Google nothing about your profile.

Security checks (Talsec freeRASP). From the first launch the game runs security checks from Talsec to detect tampered copies, hooking tools, debuggers, emulators, installs from unofficial sources and similar threats. For fraud prevention, user safety and compliance, the checks send anonymous diagnostic data off your phone (per Talsec’s user data policies):

diagnostics: information about the integrity of the app and the operating system, for example rooting, running in an emulator or use of a hooking framework;
device or other identifiers: a device model and an anonymous identifier for this app instance, used to combat bots and API abuse;
approximate location and network operator, worked out from your IP address on Talsec’s servers, used for fraud prevention and abuse detection.

Talsec says it also uses this data to improve its products and to prepare security reports and articles, and that, depending on the law that applies, it could count as sensitive or personal data. Collection cannot be switched off in the free version we use. What the game does with a finding is decided on your phone: it refuses to start on a tampered copy or under a hooking tool, and it pauses purchases and crate opening on a device with an unofficial install source, a debugger or an emulator. Findings about rooting or an unlocked bootloader are only logged. No finding is sent to our servers.

Links: Google Play data disclosure for Google’s ad software, how Google uses information from apps that use its services and Talsec’s user data policies.

We run no analytics or crash-reporting service of our own. If we add one, we will update this policy before the version that adds it is released and, where the law requires, ask for your consent in the game before any of it runs.

17.This website

The Navaye website sets no advertising or tracking cookies and runs no third-party analytics. Pages are served as static files. Fonts are loaded from Fontshare and Google Fonts, which receive your IP address and browser user agent as a normal consequence of serving those files.

The account-deletion page for The Last Run contains no form; requests are made by email.

Standard server request logs (IP address, timestamp, requested URL, user agent) may be kept by our hosting provider for a short period for security and troubleshooting.

18.Changes to this policy

We may update this policy as the game changes or the law does. The "last updated" date at the top always reflects the current version.

For changes that materially reduce your rights or materially expand what we collect, we will give notice in the game at least 14 days before they take effect and, where the law requires consent for the change, we will ask for it rather than assume it.

For minor clarifications, correction of errors, and changes required by law with immediate effect, the updated policy applies as soon as it is posted. Continuing to play after a change takes effect means you accept the updated policy.

19.Contact

For any privacy question, data request or grievance:

Navaye (sole proprietorship)
Gwalior, Madhya Pradesh, India
Email: [email protected]

Please put "The Last Run" in the subject line.