Privacy & your choices

This page explains how Last Five uses information to run the game, protect purchases and understand the player experience.

Last updated: 7 October 2026. Developer: hitbones. Contact: aqar@omaralgarni.com.

Information used to run the game

• Account and profile: Online play creates or reuses a Firebase guest identity without requiring Google. You can optionally link Google or email/password to protect and recover the same game profile. Firebase Authentication handles credentials; our game server receives a verified identity token, not your password. We store your account identifier, nickname, appearance and progress. Google may supply your display name and email. Email accounts supply an email address and verification status. An unlinked guest profile may become inaccessible after clearing app data, uninstalling or changing devices. We do not automatically delete guest accounts after 30 days.
• Gameplay and social features: we process room participation, game actions and results, rankings, experience, Coins, owned items, friend relationships, blocks and player reports. Your nickname, appearance, visible rank and results may be shown to other players and on game leaderboards. Preset phrases and expressions are visible to participants when used.
• Friends and private messages: accepted friends can see your level and online or in-match status, invite you to a party and exchange private text messages. Party membership and friend highlighting are not broadcast to unrelated players. Messages and read markers are stored on our server to deliver the conversation; messages are available for 30 days and expired records are removed periodically. They are encrypted in transit, but are not end-to-end encrypted. Only the two participants can open the conversation; when a player reports abuse, the developer can review recent messages between the reporter and the reported player. You can block or report players from Friends → More. We record acceptance of the chat rules and temporary restrictions used to respond to abuse reports.
• Public-match voice: on supported Android devices, public matches join voice in listening mode by default. Your microphone remains off until you choose to speak and grant Android microphone permission. Amazon Interactive Video Service (IVS) carries live audio to other participants in the same public match, using an opaque match-specific participant identifier. This feature is unavailable in Solo and private matches. The game does not record audio, and IVS stage recording is disabled. Voice services process connection and technical information to carry audio. You can mute individual players, mute all voices, or leave voice; your leave choice is remembered. Reports from three distinct current players mute the reported microphone for that match only. Report and mute metadata is linked to game accounts and removed after 24 hours or account deletion; audio is not attached to reports. Microphone capture stops when the game backgrounds or you leave voice. See AWS privacy information.
• Purchases: Google Play handles checkout. The game server verifies purchase references and payment state to deliver Coins and prevent duplicate grants. Purchase history, product identifiers and verification records are associated with your game account. We do not receive your payment card details.
• Support: a bug report contains the description and reproduction steps you enter, a report reference, and limited technical information such as game version, stage, mode, language, screen dimensions, connection delay and variation, state-delivery gaps, reconnect attempts, network type and game-server region. Only aggregate connection measurements are attached when you choose to send a bug report. It does not automatically attach your email, account identifier, authentication tokens or screenshots. Avoid entering sensitive information in the description.
• Connections and security: network services receive connection information such as IP addresses to deliver requests and limit abuse. The game uses secure HTTPS connections for its online service.

Google services and optional notifications

Google/Firebase provides account authentication. Google Play provides purchases and, when used, Play Games features. These services may process account, app, installation and device information needed for their features. If you enable game news, Firebase Cloud Messaging uses a notification token and your selected news language to deliver announcements. You can turn news off in game Settings or Android notification settings.

Optional analytics and advertising measurement

When configured and allowed by you, Google Analytics for Firebase measures app opens, sessions, instruction completion, stages, active playing time, tournament outcomes, store interactions and verified purchase events. Its SDK can process app-instance identifiers, device and app details, and approximate location derived from an IP address.

The separate advertising choice allows configured Google and TikTok measurement services to use gameplay and purchase events, advertising or installation identifiers, and device/network information to attribute advertising, measure campaign results and improve or personalize advertising. TikTok measurement runs only when both the service is configured and the advertising choice is enabled.

The game's custom analytics events do not include your nickname, email, Firebase account ID, room code, messages or raw purchase token. This does not mean measurement is anonymous: SDK identifiers can distinguish an app installation or device. Refusing optional measurement does not stop information needed for sign-in, online play, payments or requested support.

Changing your choice stops future optional collection through these features; it does not automatically erase information already received by a provider. You can contact us about existing data. Google's processing is also explained in its Privacy Policy.

Player journey diagnostics

When usage analytics is enabled under your saved choice or the regional privacy settings, we measure loading, practice steps, matchmaking, optional ad transitions, maps, backgrounding and technical failures using random installation/session references. With explicit diagnostic consent, bounded samples summarize frame timing, local control handling and regional network quality, with device model, Android/WebView and app versions. On supported Android devices, the next launch may report a prior process-exit category, such as a crash or low-memory termination. We do not collect screen recordings, names, messages, account IDs or raw process traces for this feature. These first-party events are retained for 30 days; unsent local records expire after seven days. Withdrawing consent clears local records and requests deletion of these first-party journey records when connected. Provider analytics follows the separate retention described above.

عند تفعيل إحصاءات الاستخدام وفق اختيارك المحفوظ أو إعدادات الخصوصية الإقليمية نقيس التحميل وخطوات التدريب والبحث والإعلانات الاختيارية والخرائط والخلفية والأخطاء بمعرّفات عشوائية للتثبيت والجلسة. وبموافقتك الصريحة على التشخيص تشمل العينات توقيت الإطارات والاستجابة المحلية وجودة الشبكة ونوع الجهاز وإصدارات التطبيق وأندرويد وWebView. قد يرسل التشغيل التالي سبب إغلاق العملية السابق مثل العطل أو نقص الذاكرة. لا نسجل الشاشة أو الأسماء أو المحادثات أو معرّف الحساب أو تفاصيل عمليات النظام الخام. تُحفظ الأحداث المباشرة ٣٠ يومًا والمحلية غير المرسلة سبعة أيام. سحب الموافقة يمسح البيانات المحلية ويطلب حذف سجلات الرحلة عند الاتصال.

Crash diagnostics and experiments

If you explicitly enable usage analytics, Firebase Crashlytics can collect native crashes, ANRs and handled failures with app/device version information. A separate first-party collector receives sanitized JavaScript source locations, error types, game build, stage and regional connection context. It excludes exception messages, player names, chat, login tokens and payment tokens. Raw first-party diagnostic events are retained for 30 days and inactive incident summaries for 90 days. Technical support reports remain restricted and use their report reference for follow-up.

Signed-in players who permit analytics may enter controlled feature experiments. The game server stores stable account-linked assignment and exposure records, foreground activity aggregates, and canonical shop/referral outcomes. Raw delivery receipts expire after eight days; account-linked experiment records are removed with your game account. Consent withdrawal or missing delivery is marked as missing coverage rather than zero activity. Screen identifiers come from a fixed list and never contain player messages or names.

Invitations, sharing and chosen reminders

Sharing is initiated by you through your device's sharing controls. Result and achievement cards include the score or earned achievement you choose to share. Invitation links contain a random token and expire after one hour for rooms or seven days for referrals. Opening a link can count a page request; it does not prove that a person installed or played the game. Android App Links and Google Play Install Referrer can retain the invitation token so you can choose to accept it after installation. Other referrer text is discarded by this feature. Existing referral eligibility and limits still apply.

You may choose a single approximate local reminder in Settings. It uses your existing Android notification permission and news preference, can be cancelled, and is suppressed after sign-out or account changes. Notification posting is measured separately from opening and playing; posting is not proof that you saw it.

Monthly ad removal

Where offered, the monthly Google Play subscription removes automatic ads while active. Optional rewarded ads remain available. Google Play displays the local price, renews the subscription monthly unless canceled, and lets you manage or cancel it. We verify purchase tokens, account binding, subscription status and expiry on our server; we do not receive your payment-card details.

Advertising and optional rewards

Starting with version 1.2.32, Unity LevelPlay mediates banners, interstitials and optional rewarded videos from Google AdMob, Unity Ads and ironSource Ads. Earlier versions may use AdMob directly. Google User Messaging Platform manages consent before ad requests; available ad privacy choices remain in Settings. Because the game includes teenage players and does not verify age, the integration uses restrictive privacy and age settings, including contextual Unity ads. The providers can process device and advertising identifiers, IP-derived approximate location, app and device information, ad interactions, performance diagnostics and ad revenue information to deliver, measure and protect ads. LevelPlay includes Ad Quality to monitor displayed ad content and ad interactions. For rewarded videos, LevelPlay receives an opaque account alias and an expiring reward ticket. Our server checks its signed callback and account binding before adding Coins. We do not send providers your Firebase account ID, password or login token. See Unity’s Privacy Policy and Google’s advertising privacy information.

When enabled, banners may appear in the waiting lobby and occasional fullscreen ads may appear at natural breaks, such as between rounds, at results, or after you confirm leaving a match. They do not interrupt active play. Rewarded ads are always optional; each verified view grants 15 Coins, available once every two hours. The ad provider can process device identifiers, approximate location, ad interactions and diagnostics to deliver, measure and protect ads. Available privacy choices are shown before ads are requested. A reward is added only after verification. A version without configured rewarded ads does not offer this feature.

Who receives information

Information is processed by the developer and the hosting, authentication, payment, notification or measurement providers needed for the features above. Public game information is visible to other players. Advertising measurement information goes to the configured advertising providers only under your advertising choice. Service providers may process data in countries other than yours.

Retention and deletion

We keep account-linked game information while your account is in use until you request deletion. Deleting your game account removes its profile, saved progress, balance, inventory, linked purchase records, results, friend relationships, private messages sent or received, chat consent and restrictions, and stored notification registrations. It does not delete your Google account, reverse a Google Play payment or automatically delete a separate Google Play Games profile.

For security, we retain a hash of the deleted account identifier and hashes of already-used purchase tokens, without the original account identifier, profile information or receipt-to-account link. These fingerprints have no automatic expiry: they prevent outstanding sign-in requests from recreating deleted game data and prevent the same purchase from being redeemed again. Bug reports are kept separately to investigate problems and are not automatically associated with an account; include your report reference when requesting their removal. Provider records and backups can be subject to the provider's retention and deletion processes.

See Delete your Last Five account for the in-app route and an email request option that does not require reinstalling the game. Contact us for access, correction or deletion requests, or questions about this policy.

Online match chat is visible to participants in that match. Match messages are available for 24 hours and expired records are removed periodically. Messages can be reported for developer review. You can mute or block participants. News notifications are enabled in the game by default, subject to Android permission; you can turn them off in Settings.