Privacy Policy for LastLane
Last updated: 10 November 2026
This policy explains what LastLane collects, why, and what you can do about it. It covers the LastLane mobile game on iOS and Android, and this website.
The rules for playing the game are a separate document, our terms of use.
1. Who we are
LastLane is made by Cito Studio, registered in Amsterdam, the Netherlands, Chamber of Commerce (KvK) number 42136766. We are the data controller for the information described here.
You can reach us about anything in this policy at contact@citostudio.nl.
2. The short version
LastLane has no accounts. You don't sign in, and we keep no profile of you and no copy of your game on our servers. Your progress stays on your phone. We measure how the game is played so we can balance it, we receive crash reports so we can fix it, we show ads, and we sell optional purchases through the App Store and Google Play. We do not sell your data, and we never see your payment details.
The rest of this page is the detail.
3. What we collect, and why
Your game progress
Your money, vehicles, boosts, best distance and settings are saved on your phone, encrypted. We don't receive them.
So that you keep your progress, the save goes into your phone's own backups: iCloud Backup on iPhone and iPad, and Android's backup to your Google Drive. On iPhone and iPad it is also kept in your own iCloud, so reinstalling the game or moving to another device signed in to the same Apple ID brings it back. Those backups are in your Apple or Google account, under Apple's and Google's policies, and we can't read them.
How the game is used
We use Google Analytics for Firebase to learn how the game is played: when a run starts and ends, how far it went and how it ended, which vehicle and map were played, which boosts were collected, used and bought, the money earned and spent, purchases and their value, and whether an ad was due or shown. Each event also carries your phone's graphics settings and the name of its graphics chip, so we can tell how the game runs on different phones.
Analytics adds information of its own: an identifier for this installation of the game, your device model, operating system and its version, the app version, your language, and the country and region your connection appears to be in. Depending on your choices in the consent form and on iOS's tracking prompt (see section 7), it may also receive your device's advertising identifier.
These records are tied to the installation, not to your name. Reinstalling the game starts a new one.
Crash reports
If the game crashes or hits an error, we receive a report through Firebase Crashlytics: what went wrong, the device model, the operating system version, the app version, and an identifier for this installation, so we can tell one player hitting a problem many times from many players hitting it once.
Game settings we change remotely
The game fetches its balance values, such as prices and how often ads show, from Firebase Remote Config. To do that, your device sends an identifier for this installation and the app's version. Nothing about how you play is sent this way.
Advertising
The game shows a full-screen ad after some rounds. Ads are served by Google AdMob, which also uses Unity Ads to fill some of them. Ad networks are separate companies and use information about your device, such as its advertising identifier, its IP address and the ads you see and tap, for their own purposes too, including measuring and personalising ads. Their handling of it is governed by their own policies:
On iPhone and iPad we ask whether you allow tracking, with Apple's App Tracking Transparency prompt. If you say no, the advertising identifier (IDFA) isn't used, and you still see ads, they are just less relevant to you. You can change your answer at any time in iOS Settings, under Privacy & Security, Tracking.
On Android, ads may use your advertising ID, which you can reset or delete in your Android settings.
If you buy No Ads, the game shows you no ads and loads none.
Purchases
Money packs, No Ads and some vehicles are sold through the App Store and Google Play. The store takes your payment. We never see your card details.
We use RevenueCat to check that a purchase is real and to keep track of what it unlocks, under a random identifier RevenueCat creates for your installation, not your name. RevenueCat receives the purchase's details from the store: what was bought, when, its price and currency, the store's transaction number and your country. When you tap RESTORE PURCHASES, the store tells RevenueCat which purchases your Apple ID or Google account owns, so they come back. RevenueCat's policy: revenuecat.com/privacy.
This website
This website doesn't use cookies, doesn't count visits and loads nothing from other companies. Like any website, its host, Google's Firebase Hosting, sees your IP address and browser in its server logs, which expire.
If you write to us, we keep your email and our reply for as long as we need to answer you.
4. What we do not collect
- Your name, email address or phone number, unless you write to us.
- Your payment details. The stores handle those.
- Your precise location, contacts, photos, camera, microphone or files.
- Your game progress, which stays on your phone and in your own backups.
We do not sell your personal information, and we do not share it with data brokers.
5. Who else sees it
We use these companies to run the game. They process data on our instructions, except for the ad networks, which act for themselves as well.
| Who | What for |
|---|---|
| Google (Firebase) | Analytics, crash reports, remote settings, hosting this website |
| Google (AdMob) | Serving ads, measuring them, and the consent form |
| Unity Technologies | Serving ads, through AdMob |
| RevenueCat | Checking purchases and keeping track of what they unlock |
| Apple, Google | The app stores, payments, and your device's backups and iCloud |
If we add ad networks, we will name them here before they run.
Some of these companies are in the United States. Where your information leaves the European Economic Area, they protect it with the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
6. Why we are allowed to (legal bases)
If you are in the European Economic Area, the United Kingdom or Switzerland, the law asks us to name a basis for each use:
- Performing our contract with you: your purchases, and fetching the game's settings. Without these, we can't give you the game you bought or what you paid for.
- Our legitimate interests: crash reports, and usage analytics where you haven't been asked for consent. We want to find what breaks and which parts of the game lose players. Neither identifies you by name.
- Your consent: personalised advertising, the ad networks' storing and reading of information on your device, and, where the consent form asks, usage analytics. You give it in the consent form or the tracking prompt, and you can take it back.
7. Your consent choices
Where the law requires it, in the European Economic Area, the United Kingdom, Switzerland and US states with privacy laws, the game shows Google's consent form the first time the main menu appears after the guided first run, before any ad loads. Your answers decide whether ads may be personalised, and Google Analytics follows them too. Saying no doesn't remove ads; it makes them generic.
You can change your answers at any time from PRIVACY CHOICES on the game's settings screen. It shows only where the form applies.
On iPhone and iPad, a short explanation and then Apple's tracking prompt follow. See section 3, Advertising.
8. How long we keep it
- Your game progress stays on your phone and in your backups until you delete the game and its backups. We hold none of it.
- Analytics: the individual events for 2 months, and what's tied to your installation for up to 14 months after it was last used, then they're deleted automatically. Totals that identify no one, such as how many runs were played on a day, are kept.
- Crash reports for up to 90 days.
- Purchase records at RevenueCat and the stores, for as long as tax and accounting rules require.
- Emails you send us, for as long as we need to answer you.
9. Your rights
If you are in the European Economic Area, the United Kingdom or Switzerland, you can ask us for a copy of your data, to correct it, to delete it, to restrict what we do with it, or to hand it to someone else. You can object to anything we do on the basis of legitimate interests. Where we rely on your consent you can withdraw it, which doesn't make what we did before unlawful.
Because LastLane has no accounts, we can only find your analytics and crash records by your installation's identifiers. If you want them deleted, the simplest way is to delete the game: a new installation starts new records, and the old ones expire as section 8 says. You can also write to us.
If you are in California or another US state with a privacy law, you can ask what we collect and ask us to delete it, and you won't be treated differently for asking. You can opt out of personalised ads through the consent form described in section 7.
Write to contact@citostudio.nl. We will answer within one month.
You can also complain to a data protection authority. Ours is the Dutch Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl, and you may instead go to the authority where you live. If something worries you, we would rather hear from you first.
10. Children
LastLane is meant for players aged 13 and over and isn't aimed at children. We don't knowingly collect information from children under 13. If you believe a child under 13 has given us information, write to contact@citostudio.nl and we will delete what we can find.
11. Changes to this policy
When we change this policy, we update the date at the top. If a change matters, we will also say so in the game before it takes effect.