Privacy Policy

Last updated 26 October 2026

1. Who we are

This policy covers Last Stand (the game and its game servers), the website at laststandgame.xyz (including your account page), and Last Stand Bot (our Discord bot). They're made and run by Koaxy, an independent developer based in the United Kingdom, who is the data controller for the information described here. In this policy, "we" and "us" means Koaxy.

Questions, requests or complaints: email koaxygames@gmail.com, or open a ticket in the Last Stand Discord server.

2. What we collect and why

Your Last Stand account

• Account name, shown in games, on leaderboards and on your public profile page.
• Password, if you make one. We only ever store a salted hash of it (PBKDF2-SHA256), never the password itself, so we can't read it.
• Discord account, if you sign in with or link Discord: your Discord user ID and username. We only ask Discord for the "identify" permission, so we never see your email address or the servers you're in.
• Sign-in sessions: when you sign in, your game or browser keeps a sign-in token. We store only a hash of it, and it expires after 90 days.
• When your account was made and last used, and, if it has been banned, when, why and by whom.

Why: to give you an account, keep it secure, and let you sign in. (Lawful basis: performing our agreement with you, the Terms of Service.)

Your games and progress

• For each game you play on the official server: the map, the wave you reached, kills, headshots, revives, times you went down, how long you played, whether you escaped, and how many players were in the game.
• Your level, achievements and the in-game milestones they're based on.

Why: to show your stats, levels, achievements and the leaderboards. These are public: your profile page and the leaderboards on the website show your name and stats to anyone. Results of games, level-ups and achievements may also be posted in the Last Stand Discord server. (Lawful basis: performing our agreement with you.)

Playing on our game servers

• Your IP address, which any online game needs in order to connect you. It's checked against our ban list, and kept on that list if you're banned by IP.
• Server logs: when players join and leave, their names, game events, and what our anti-cheat noticed (for example, moving faster than the game allows). Logs are rotated automatically and kept only for a limited time.
• In-game chat is shown to the other players in your game. We don't keep a record of it.

Why: to run the game, keep it fair, and deal with cheating and abuse. (Lawful basis: our legitimate interest in running a fair, working game.)

The website

• Cookies: only the ones needed to keep you signed in. A sign-in cookie (lasts up to 90 days) and a short-lived cookie while you sign in with Discord (10 minutes). We use no advertising, analytics or tracking cookies, so there's nothing to opt out of.
• IP address: used briefly, in memory only, to limit how often someone can try to sign in or make accounts, which protects against password guessing.

Last Stand Bot (in Discord servers)

When the bot is in a Discord server, it receives the data Discord sends bots there. What it keeps depends on which features that server's staff have turned on:

• Messages are read as they're sent, to check them against the server's automod rules and to give members chat XP. Message text is not saved to our database. A short-lived in-memory copy of recent messages is kept so that, if the server has a log channel, edits and deletions can be shown there.
• Server and member IDs, plus each member's chat XP and level.
• Moderation records: warnings, timeouts, kicks and bans made through the bot, including who was actioned, by which moderator, and the reason.
• Tickets: who opened a ticket, its subject, and when and why it was closed. When a ticket is closed, a transcript of it is posted to the server's own log channel in Discord.
• Suggestions, votes and giveaway entries, and temporary roles (who has one and when it ends).
• Server settings chosen by its staff: channels, roles, automod rules, level rewards and so on.

Why: to provide the features each server's staff have set up. (Lawful basis: our legitimate interest, and that of the server's owners, in running and moderating their community.) Server staff can see the moderation, ticket and level information for their own server.

The game on your computer

• Your sign-in token and your settings are saved on your own computer.
• The game checks our website for updates when it starts, which sends your IP address to our server like any web request.
• Discord status: if Discord is running, the game can show what you're playing on your Discord profile. You can turn this off in the game's Settings.
• Games hosted by friends (not on our official server) are connected through Unity Gaming Services (Relay and Lobby), which give your copy of the game an anonymous Unity player ID. Unity's own privacy policy applies to that.

3. Who else handles your data

We don't sell or rent your data, and we don't share it for advertising. We use these services to run things:

Some of these companies are based in, or process data in, the United States. Where that happens, they use the safeguards the law requires, such as standard contractual clauses or the UK–US data bridge.

We may also share information if the law requires it, or if we need to protect people's safety or deal with serious abuse.

4. How long we keep it

• Accounts, stats and achievements: for as long as your account exists. If you ask us to delete your account, we delete it along with its stats, achievements and sessions.
• Sign-in sessions: up to 90 days, or until you sign out.
• Server logs: a limited time, after which they're rotated out automatically.
• Bans: for as long as the ban lasts.
• Discord bot data: for as long as the server uses the bot, or until its staff or the member concerned asks us to delete it.

5. Your rights

Under UK data protection law (the UK GDPR), and similar laws elsewhere, you can ask us to:

• give you a copy of the data we hold about you;
• correct it (you can change your name and password yourself on your account page);
• delete it, including your whole account;
• stop or limit how we use it, or object to how we use it;
• give it to you in a format you can take elsewhere.

To do any of these, contact us (see section 1). We'll reply within one month. If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live.

6. Children

Last Stand, the website and the bot are not meant for children under 13, or under the minimum age for using Discord where you live if that's higher. We don't knowingly collect data from children under that age. If you believe a child has made an account, contact us and we'll delete it.

7. Keeping it safe

Passwords and sign-in tokens are stored only as hashes. Connections to the website are encrypted (HTTPS). The database can only be reached from our own server, and internal services only accept requests from our own game server. No system is perfectly secure, but if a breach ever puts your data at risk, we'll tell you and the authorities as the law requires.

8. Changes to this policy

If we change this policy, we'll update the date at the top. For significant changes, we'll also announce them in the Last Stand Discord server or in the game.