PRIVACY POLICY

1. WHO WE ARE

M Designs
Marco Hol
Groningen, Netherlands
Chamber of Commerce (KvK): registered sole proprietor, Netherlands
Email: info@blitzlaststand.com
Website: www.blitzlaststand.com

M Designs is the data controller for all personal data collected via this website and game, as defined under the General Data Protection Regulation (GDPR / AVG).

2. WHAT DATA WE COLLECT

Website (blitzlaststand.com)

Data	Purpose	Storage
Email address (newsletter opt-in only)	Sending game launch updates and announcements. You sign up voluntarily with explicit consent.	Our EU-based server — never shared with third parties
Server logs (IP address, browser type, timestamp)	Standard server security, uptime monitoring and error diagnosis	Web hosting provider (EU-based) — automatically deleted after 30 days

The Game

Data	Purpose	Storage
Player name (entered voluntarily)	Global leaderboard score entry	Our server — publicly visible on the leaderboard
High score & wave reached	Leaderboard display	Our server — publicly visible
Game progress (highest wave, unlocked operators, currency)	Save your progress between sessions	Your device's localStorage only — never sent to our servers
Game settings (volume, performance mode, display)	Remember your preferences	Your device's localStorage only — never sent to our servers

Purchases (Steam / itch.io)

Blitz: Last Stand is sold via Steam (Valve Corporation) and itch.io. We never process or store your payment information. All payment processing is handled exclusively by Steam and itch.io under their own privacy policies and terms. Please review:

• Steam Privacy Policy
• itch.io Privacy Policy

We do not collect:

• Tracking pixels or advertising data
• Social media data
• Payment or financial information
• Precise location data
• Data from children under 13

3. LEGAL BASIS (GDPR — Art. 6)

We process your data on the following legal grounds:

• Consent (Art. 6(1)(a)) — newsletter subscription via explicit opt-in checkbox; leaderboard name submission
• Legitimate interest (Art. 6(1)(f)) — server logs for security and technical stability of the service

4. COOKIES & LOCAL STORAGE

This website does not use tracking, analytics, or advertising cookies of any kind.

All website fonts (Bebas Neue, Rajdhani, Roboto Mono) are self-hosted on our own server. No font data is sent to Google or any other third party.

The game uses your browser's localStorage (not cookies) to save your progress and settings locally. This data never leaves your device. You can clear it at any time via your browser settings (Settings → Privacy → Clear browsing data).

Because we do not use tracking cookies or third-party scripts that set cookies, no cookie consent banner is required under the Dutch Telecommunications Act (Telecomwet) or GDPR.

5. SHARING YOUR DATA

We do not sell, trade, rent, or share your personal data with third parties for commercial purposes.

Your data is only shared with:

• Our web hosting provider (EU-based server infrastructure) — for hosting the website and game files. They process server log data under a data processing agreement.
• Law enforcement or regulatory authorities — only when required by applicable Dutch or EU law.

6. INTERNATIONAL TRANSFERS

All data we collect is stored and processed within the European Union. We do not transfer personal data to countries outside the EU/EEA.

7. DATA RETENTION

Data	Retention period	Reason
Newsletter email addresses	Until you unsubscribe	Consent-based; withdrawn on request
Leaderboard entries (name + score)	Indefinitely (public record)	Game integrity; removable on request
Server logs	Maximum 30 days	Security monitoring
LocalStorage (your device)	Until you clear your browser data	Under your own control

8. YOUR RIGHTS (GDPR — Art. 15–22)

As a data subject under GDPR, you have the right to:

• Access (Art. 15) — request a copy of the personal data we hold about you
• Rectification (Art. 16) — request correction of inaccurate or incomplete data
• Erasure (Art. 17) — request deletion of your data ("right to be forgotten")
• Restriction (Art. 18) — request that we limit processing of your data
• Data portability (Art. 20) — receive your data in a structured, commonly used format
• Objection (Art. 21) — object to processing based on legitimate interest
• Withdraw consent (Art. 7(3)) — unsubscribe from the newsletter or revoke any other consent at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, email info@blitzlaststand.com. We will respond within 30 days as required by GDPR Art. 12.

9. LEADERBOARD

The global leaderboard stores the player name you voluntarily enter, together with your score and highest wave reached. This data is publicly visible to all players worldwide. Do not enter your real full name, email address, or any personal identifiers as your leaderboard name.

To request removal of a leaderboard entry, email info@blitzlaststand.com with the name and score. We will process the request within 30 days.

10. CHILDREN'S PRIVACY

Blitz: Last Stand is rated PEGI 12 / ESRB T (Teen) due to military violence and combat themes. We do not knowingly collect personal data from children under the age of 13. If you believe a child under 13 has submitted personal data through this website or game, contact us immediately at info@blitzlaststand.com and we will delete the data without undue delay.

11. EXTERNAL LINKS

This website contains links to external platforms including Steam, itch.io, and YouTube. This privacy policy does not apply to those third-party sites. We recommend reviewing their respective privacy policies before providing any personal data.

12. SECURITY

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss or destruction, including:

• FTPS (FTP over TLS) encryption for all server file transfers
• Server-side input validation on all form submissions
• File-level access controls on stored email lists
• No transmission or storage of payment data

No method of internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security, but we take all reasonable precautions.

13. COPYRIGHT & INTELLECTUAL PROPERTY

Game & Software

Blitz: Last Stand — including its source code, game mechanics, systems, user interface, visual design, and all original content — is the exclusive intellectual property of M Designs (Marco Hol). The game engine is built entirely in HTML5, JavaScript (ES modules), and Canvas 2D — no game engine was used. All original code is copyright © 2026 M Designs.

Brand & Name

The name Blitz: Last Stand, the game logo, the saw-blade badge design, and associated branding are original works of M Designs. Unauthorised use of the name or brand in commercial contexts is prohibited.

Third-Party Assets Used Under Licence

Asset type	Source	Licence
Music & sound effects	Pixabay	Pixabay Content Licence — free for commercial use, no attribution required
Character sprites & visual assets	Higgsfield AI	Commercial licence confirmed
Fonts (Bebas Neue, Rajdhani, Roboto Mono)	Google Fonts / self-hosted	SIL Open Font Licence (OFL) — free for commercial use

Prohibited Uses

Without prior written permission from M Designs, you may not:

• Copy, reproduce, or distribute the game code or original assets
• Reverse-engineer, decompile, or create derivative works based on the game
• Use the Blitz: Last Stand name, logo, or branding for commercial purposes
• Claim ownership or authorship of any part of the game

Fan art, let's plays, reviews, and non-commercial community content are explicitly welcome. For licensing enquiries: info@blitzlaststand.com

14. CHANGES TO THIS POLICY

We may update this privacy policy to reflect changes in our data practices or applicable law. The date at the top of this page will always reflect the most recent revision. Material changes will be communicated via the newsletter where appropriate. We encourage periodic review of this policy.

15. CONTACT & COMPLAINTS

For questions, privacy requests, or complaints:
Email: info@blitzlaststand.com
Response time: Within 30 days (GDPR Art. 12)

If you believe your GDPR rights have been violated and our response is unsatisfactory, you have the right to lodge a complaint with the Dutch Data Protection Authority:
Autoriteit Persoonsgegevens — autoriteitpersoonsgegevens.nl