← One Last Heist

Privacy policy — One Last Heist

Publisher: Styvens Wentz EI (Entrepreneur individuel, French sole proprietorship), trading as Pixel & Quill Studio
SIREN: 131 995 391 — SIRET: 131 995 391 00011 — APE code: 6201Z (computer programming)
Address: 138 avenue Victor Hugo, 75016 Paris, France
Contact: contact@pixelandquillstudio.com
Last updated: October 28, 2026

This policy applies to the mobile game One Last Heist (“the Game”). It completes the Pixel & Quill Studio privacy policy, which applies to all the studio's games; for the Game, this page gives the details and prevails where the two differ. One Last Heist is in production: this page describes the version planned for release on Google Play. Services marked planned are not active in the Game yet.

1. Publisher and data controller

Styvens Wentz EI, trading as Pixel & Quill Studio (“the publisher”), is the data controller for the processing described below, except where Google acts as an independent controller for its own services (Google Play Games, Google Play Billing, AdMob).

2. What the Game does not do

• It never asks for your real name, email address, password or full date of birth.
• It has no account system of its own: you play as a guest or with Google Play Games.
• It does not access your contacts, location, camera, microphone or photos. The only Android permissions it uses are internet and network status (ads and Google services) and vibration (haptic feedback).
• The publisher does not sell your data.

3. Data processed

3.1 Age bracket

At first launch, the Game asks for your year of birth only and turns it into an age bracket (under 13, 13–14, 15–17, 18 and over). Only the bracket is kept, on your device; the year is neither stored nor sent.

3.2 Local save (on your device)

Your progress (reputation, crew, targets, careers, achievements), your settings (language, sound, haptics), your player profile (the first name you choose, the face you pick from the Game's own drawings and, in French, whether the texts address you as a man or a woman), the version of the terms you accepted, your guest or Google choice and your ad choices. This data stays on your device and is protected against tampering by a signature. The publisher has no access to it.

3.3 Google Play Games (optional)

If you sign in, Google provides the Game with your player ID and your Play Games gamer name, for achievements, the leaderboard and, once available, cloud save. In guest mode, the Game does not call Google Play Games and the leaderboard stays locked.

3.4 Purchases (Google Play Billing)

Google processes the payment. The Game receives only the product ID, a purchase token and its status, to unlock the content. The publisher never receives your payment details.

3.5 Ads and consent (Google AdMob and UMP)

The Game shows ads served by Google AdMob: banners, an ad between two jobs (never during a job or the tutorial) and rewarded ads, always optional. AdMob may process your device's advertising ID, your IP address, technical information about the device and ad interaction data, to serve, measure and, with your consent, personalise ads. In the European Economic Area, the United Kingdom and Switzerland, Google's consent form (UMP) records your choice. You can change it at any time in My account → Manage ad choices. For every player, ads are limited to content rated “T” (Teen) or lower.

3.6 Players under 15

If the age bracket shows you are under 15 (the age of digital consent in France), ad requests are tagged “under the age of consent” and only non-personalised ads are requested. No consent form is shown.

3.7 Anti-cheat (Google Play Integrity)

To protect the leaderboard and purchases, the Game may request an integrity verdict on the device and the app from Google Play Integrity, and checks that the results it posts (duration, scores) are plausible.

3.8 Planned online services (not active)

The following services are planned and not active in the Game. Until they are, no game data is sent to the publisher.

• Cloud save and game servers (Google Firebase): a technical ID or an ID linked to your Play Games account, a copy of your progress, your purchase entitlements (checked with Google on the server) and the results posted to the leaderboard, for verification.
• Analytics (Google Analytics for Firebase): game events (start and end of a heist, tutorial, screens), device model, Game version and approximate country. Never for players under 15, and only with your consent where the law requires it.
• Crash reports (Firebase Crashlytics): technical error trace, device model, Game version and an installation ID.

Before any of them is switched on, this policy and the studio-wide privacy policy will be updated and the Game will ask you to accept them again.

4. Purposes and legal bases (GDPR)

5. Recipients and transfers

Data is processed by Google (Google Ireland Limited / Google LLC: Google Play Games, Google Play Billing, AdMob, UMP, Play Integrity and, once active, Firebase), as processor or independent controller depending on the service, and by AdMob's advertising partners to the extent of your consent. Some data may be transferred outside the European Union, notably to the United States; Google covers these transfers with the European Commission's standard contractual clauses and the EU–US Data Privacy Framework. Google's policy: policies.google.com/privacy. How ads work: policies.google.com/technologies/ads.

6. Retention

• Data on your device: until you delete it in My account, clear the app data or uninstall the Game.
• Google Play Games, billing and advertising data: according to Google's rules.
• Purchase records: for the legal accounting retention period.
• Planned services, once active: server data while your account is in use, deleted at the latest 30 days after a deletion request or after 24 months of inactivity; analytics 14 months at most; crash reports 90 days.

7. Your rights

Under the GDPR and the French Data Protection Act, you have the right of access, rectification, erasure, restriction, objection and portability, the right to withdraw your consent at any time (My account → Manage ad choices) and the right to give instructions on what happens to your data after your death.

Deleting your data: My account → Delete my account and data erases the save, settings, profile, declared age, accepted terms and ad choices on the device; once online services are active, it also requests deletion of the data linked to your player ID on the servers. Your purchases stay tied to your Google Play account and can be restored. You can also write to contact@pixelandquillstudio.com; a reply is given within one month.

You may lodge a complaint with the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr) or with the data protection authority of your country.

8. Children

The Game is not intended for children under 13: if the year of birth shows an age under 13, the Game stays locked and no data is sent. Between 13 and 17, the Game reminds you to ask a parent or legal guardian for permission before playing and before any purchase. Under 15, only non-personalised ads are requested. If you believe a child under 13 has provided data, contact the publisher so it can be deleted.

9. Security

The local save is signed to detect tampering. Exchanges with Google services are encrypted (HTTPS). The Game keeps the data it uses to a strict minimum.

10. Changes

The publisher may update this policy. The date at the top of this page will be updated and, for any significant change, the Game will ask you to accept the policy again before you continue.

11. Contact

Styvens Wentz EI, trading as Pixel & Quill Studio — 138 avenue Victor Hugo, 75016 Paris, France — contact@pixelandquillstudio.com

See also the terms of use of One Last Heist.