Privacy & Cookie Policy

Last updated October 2026

This dashboard ("the Site") is an independent, fan-made companion tool for the mobile game Last War: Survival. It is not affiliated with, endorsed by, or sponsored by FUNFLY PTE. LTD. or any official publisher of the game. This policy explains what data we collect, why, and how it's used.

Who runs the Site

The Site is run by an independent operator (username “hudemane”, Italy), who is the data controller. For any privacy request or question, write through the Contact page.

What we collect

  • Account data: email address, a hashed password (we never store your password in plain text), your display name and your in-game nickname.
  • Alliance data: alliance name/tag/server and roster information — nicknames, ranks, game stats and their history, notes, profile pictures and optional birthdays — entered by you or by your alliance's admins, who may also add players who have no account.
  • Activity data: VS scores, Desert Storm and Canyon Storm assignments and attendance, event attendance, Alliance Train history, calendar events, and the wall posts, comments and poll votes you or your admins create.
  • Messages and forms: feedback you send, the contact form (name, email, message) and public recruitment submissions (nickname, server, previous alliance, stats, notes).
  • AI features: when your alliance uses the AI Assistant or the AI screenshot import, your questions, the screenshots and the related game data (nicknames, stats) are sent to OpenAI through your alliance's own API key. Assistant chats are stored for the person who had them until they are deleted.
  • Technical data: IP address and request records used for security and abuse prevention, such as rate limiting and failed sign-in attempts, which are kept for short periods.

How we use it

To run the features of the dashboard — authentication, alliance management, statistics, scheduling, and responding to feedback or support requests — to keep the Site secure, and to cover its costs through advertising (see below).

Why we process your data (legal bases)

Where the GDPR applies, we rely on the following bases:

  • Running your account and the features you use — sign-in, alliance tools, wall, calendar, and the AI features your alliance enables: performing the service you asked for (contract).
  • Security and abuse prevention — rate limiting, failed sign-in records, logs: our legitimate interest in keeping the Site and its users safe.
  • Alliance roster and activity data entered by admins about players — nicknames, ranks, game stats, history, attendance, notes: the legitimate interest of the alliances and of the operator in running a shared coordination tool, using data that is mostly visible to other players in the game itself. You can object at any time (see Your rights).
  • Optional details you choose to add, such as a birthday or a profile picture: your choice, which you can change or remove at any time from your profile.
  • Replying to your feedback, contact and recruitment messages: our legitimate interest in answering you and, when you ask for something, taking steps at your request.

Advertising is provided by a third-party network that decides how it processes data in your browser; see “Cookies, local storage & third-party scripts” above.

Where the data comes from: from you, from your alliance's admins (who may add players who have no account, using what is visible in the game), and from the features themselves, for example stats read from screenshots. An email and password are required to create an account; everything else is optional or depends on what your alliance chooses to record.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Stats, scores and AI answers are tools for the people (alliance leaders) who decide.

Who receives data

We share data only with the providers that make the Site work, and only what each one needs:

  • Google Cloud (hosting, file storage and secrets) and MongoDB Atlas (database): store and process the Site's data on our behalf.
  • Resend: sends transactional emails such as password resets (your email address and the reset link).
  • Google reCAPTCHA: protects sign-in, registration, password reset and demo start from bots; it receives technical information from your browser.
  • OpenAI: only when your alliance uses the AI Assistant or the AI screenshot import — questions, screenshots and the related game data are sent using your alliance's own API key.
  • Discord: only if your alliance's admins connect a webhook — event titles, descriptions and images are posted to the channel they chose.
  • Adsterra and its advertising partners: connect directly with your browser to show banner ads (see Cookies above).
  • Other members of your alliance see roster and activity data according to their role. Calendar feed links are secret URLs that anyone who has them can read; R4/R5 can regenerate them.
  • Ko-fi: if you buy an ad-free code in our Ko-fi shop, Ko-fi passes us your email and the order details only so we can send you the code. We do not store the email.

We may also disclose data where the law requires it or to protect the Site and its users.

Transfers outside the EU/EEA

The Site's application runs on Google Cloud in Belgium (europe-west1). Some providers listed above — for example OpenAI, Resend, Discord, Adsterra and Google services — may process data outside the EEA, including in the United States. Where that happens we rely on the transfer mechanisms those providers offer, such as the EU–US Data Privacy Framework or the EU Standard Contractual Clauses.

Cookies, local storage & third-party scripts

The Site uses two strictly necessary cookies to keep you signed in: a short-lived access cookie (15 minutes) and a refresh cookie (up to 30 days). Both are HttpOnly, so scripts cannot read them. Your browser's local storage also holds display preferences that are not sent to our servers — language, server/local time, sidebar state, selected AI model and dismissed pop-ups. You can clear them at any time from your browser.

The Site occasionally shows a "Support This Project" card linking to our Ko-fi page. This card is built by us and sets no cookies or third-party scripts on its own — only if you click through do you leave the Site and become subject to Ko-fi's own privacy policy.

The Site shows a banner ad served by Adsterra on some pages (never on the sign-in, registration, password reset, contact or cookie settings pages). Adsterra and its advertising partners may set cookies or use identifiers in your browser to serve and measure ads. The banner runs in an isolated frame that cannot access your session or your data on the Site. There is currently no consent prompt or on/off switch on the Site for these ads; you can block them with your browser settings or a content blocker. Google AdSense is not active. See Privacy & cookie settings.

Data retention & deletion

Your account data is kept for as long as your account is active. You can delete your own account at any time, with no need to go through the Contact page — just go to your Profile page and use the "Delete Account" option under Danger Zone. This permanently removes your login (email, password), your AI Assistant chats, your wall posts, comments, likes and poll votes, and the profile picture and birthday on your roster entry, and disconnects the account from your alliance.

Your roster entry stays with your alliance: your in-game nickname, game stats, history (VS, Desert Storm, Canyon Storm, Alliance Train, event attendance) and notes are data about your game character that other players can also see in the game, and the alliance needs them for its records. After you delete your account the entry is no longer linked to you. You can ask an R4/R5 of your alliance to remove you from the roster, or write to us via the Contact page. Technical backups are kept for a limited period.

How long we keep data:

  • Account and profile: while your account exists; removed when you delete it (see above).
  • Sign-in sessions: access cookie 15 minutes, refresh cookie up to 30 days; failed sign-in records: 24 hours.
  • AI usage logs (what was asked, model, token counts): 90 days. AI Assistant chats: until you delete them or your account.
  • Roster entries, stats and history: as long as the alliance keeps them. A member removed by an admin is hidden from the active roster but stays in historical records; you can ask us to erase it.
  • Feedback and contact messages: as long as needed to handle them and keep the history of requests; you can ask us to delete yours.
  • Demo sessions: deleted automatically after about one hour. Technical backups: kept for a limited period and then rotated.

Your rights

Where the GDPR or a similar law applies to you, you can ask for access to your data, correction, erasure, restriction or objection to processing, and a copy in a portable format; where processing relies on consent you can withdraw it at any time. Write through the Contact page and we will answer within one month. We may ask you to confirm you are the person concerned, and only what is needed to do so. This also applies if you have no account but appear in an alliance roster. Much of it you can do yourself from your Profile: edit or remove your birthday and picture, delete AI chats, and delete your account.

You also have the right to lodge a complaint with a data protection authority — in Italy, the Garante per la protezione dei dati personali — or with the authority of your country of residence.

Children

The Site is not directed at children and we do not knowingly collect data from children under 14. If you believe a child has provided data, contact us and we will remove it.

Contact

Questions about this policy or your data? Reach out via the Contact page.