What the game knows about you

Last updated 14 October 2026 · Effective for all versions of the app

The short version: The Last Pistachio has no ads, no accounts and no tracking. Your progress lives on your phone. If you use the online features (today's bowl, leaderboards, challenges), the app sends your results under a random identifier that is not linked to your name, e-mail or anything else about you. You can delete that data at any time.

1. Who we are

The Last Pistachio (the "app") is made and published by MM Rešitve d.o.o., Dovce 30, 1381 Rakek, Slovenia ("we", "us"). We are the data controller for any personal data described in this policy. You can reach us at info@mm-resitve.com.

2. Data stored on your device

The app keeps the following on your phone only, in the app's private storage:

your progress: bowls cleared, dots and badges, records and best times, kernels in the pantry, golden pistachios found, your daily streak;
your settings: sound, vibration, tilt, the chosen bowl, the finger mode;
your tools and purchases (unlocked content).

We never see this data. If your phone's system backup (Google backup on Android, iCloud on iOS) is turned on, your phone may include it in the backup, under the terms of that service. Uninstalling the app removes it from the phone.

3. Online features

Some features need our server: today's bowl, weekly challenges, leaderboards and challenge links. When you use them, the app sends:

a random player identifier that the app creates on first use. It is not derived from your name, e-mail, phone number, advertising ID or any other identifier of you or your device, and we cannot connect it to you;
your results: the bowl played, the time, dots and badges, and the moment you played;
your country, worked out from your network connection by our hosting provider (see below), so you can appear on your country's leaderboard. We do not store more precise location.

Leaderboards show a short name you choose in the app, or nothing at all. Do not use your real name if you do not want it shown.

The legal basis for this processing is the performance of our contract with you (Article 6(1)(b) GDPR): we cannot run a shared daily bowl or a leaderboard without recording results. The server is in the European Union.

4. Technical data

Like any internet service, our server and its protection layer (Cloudflare, Inc.) see the IP address of your connection while a request is handled. We use it only to deliver the response, to limit abuse (for example too many requests from one address) and to detect attacks. For abuse limits we keep a one-way hashed form of the address for at most 24 hours; we do not keep IP addresses in readable form. The legal basis is our legitimate interest in keeping the service working and fair (Article 6(1)(f) GDPR).

The app does not contain analytics, advertising or tracking software from any company.

5. Purchases

In-app purchases are made through Google Play (and, on iOS, the App Store). The store handles the payment and knows your identity; we never receive your card or bank details. We receive a purchase token and the product bought, so the app can unlock it and so we can verify the purchase with the store. Google's processing is described in Google's privacy policy.

Purchases in The Last Pistachio unlock content and tools. They never give a time advantage over other players, and there are no advertisements to remove, because there are none.

6. How long we keep data

Results and leaderboard entries: as long as your player identifier exists, or until you delete them.
Hashed IP addresses for abuse limits: up to 24 hours.
Purchase records: as long as needed to restore your purchases and to meet tax and accounting rules.

7. Sharing

We do not sell or share your data with anyone for their own purposes. Only the companies that run our infrastructure process it on our behalf and under our instructions: Cloudflare (network protection, delivery) and our hosting provider in the EU. Google Play and Apple process purchases as independent controllers.

8. Children

The app is not directed at children under 13 and has no account, chat or social feature. We do not knowingly collect personal data from children. If you believe a child has sent us data through the online features, write to us and we will delete it.

9. Your rights and deleting your data

Under the GDPR you may ask us for access to your data, its correction or deletion, a restriction of processing, or a copy in a portable form, and you may object to processing based on our legitimate interests. You can also complain to the Information Commissioner of the Republic of Slovenia (www.ip-rs.si) or to the supervisory authority of your own country.

Deleting your online data is built in: in the app, open Settings and tap Delete my data. All results stored under your player identifier are deleted, and the identifier itself with them. You can also ask by e-mail; because the identifier is random, we will ask you to send the code shown in the app's settings. Full instructions are on the page Delete your data.

Data on your phone is deleted by uninstalling the app or clearing its storage in your phone's settings.

10. Changes

If this policy changes, the new version will be published here with a new date. If the change matters for you (for example a new online feature that sends more data), the app will tell you before it starts sending.

11. Contact

MM Rešitve d.o.o., Dovce 30, 1381 Rakek, Slovenia · info@mm-resitve.com