Last Join waitlist
Menu
← All legal and safety documents

Privacy Policy

LAST

PRIVACY POLICY

Effective Date: October 31, 2026

This Privacy Policy (the “Policy”) explains how Elysian Studios LLC (“Company,” “Last,” “us,” “our,” or “we”) collects, uses, discloses, retains, and otherwise processes personal information in connection with the Last mobile application and related member services (collectively, the “Service”). Section 2.O describes the information Last processes about visitors to the lastdating.app website who are not members, including how Last tracks and analyzes use of the website. This Policy should be read together with the Terms of Use and any additional notice presented at or before a particular collection or processing activity.

Separate notices may apply to the website waitlist or closed-beta application, biometric verification, analytics and matching-model processing, subscriptions and purchases, promotions, events, or other specialized features. If a specialized notice applies to a particular processing activity, that notice supplements this Policy for that activity.

The Service is intended for adults in enabled United States markets. It is not intended for anyone under 18. Availability may be limited by market, jurisdiction, product stage, verification-provider coverage, or other legal or operational requirements.

1. SUMMARY OF IMPORTANT PRACTICES

Last’s current product design includes the following important privacy practices:

2. INFORMATION WE COLLECT

The categories below describe the information the Service is designed to collect or generate. A particular feature may not be enabled for every account, market, platform, or release stage.

A. Account, authentication, and security information

We collect or generate information used to create, authenticate, secure, and administer your account, including:

Your private username is separate from your public display name and is not displayed to other members. Former usernames may remain reserved against reassignment for the period described in the Terms of Use and applicable account rules.

We also keep a record of your acceptance of the Terms of Use: the Terms, Privacy Policy and dispute-resolution notice versions you accepted, when you accepted them and on what device, and whether and when you opted out of arbitration. While your account exists this record is part of your account and is not erased by Reset Account. When your account is permanently deleted, the record is deleted with it except for a legal acceptance record that contains no name, phone number, device identifier, account identifier or research identifier: a keyed code derived from your verified identity under a key used for nothing else, the document versions you accepted with their dates, your arbitration opt-out status, and the dates your membership began and ended. That legal acceptance record is kept for four years after deletion, is used only to establish or defend legal claims, is never used for matching, research or advertising, and is then deleted. If you opt out of arbitration by email or post within your 30-day window after your account has been deleted, we update that record. We keep it even if you ask us to delete your personal information, as the law allows for records needed to establish or defend legal claims. It is not anonymous: with the dedicated key and your verified legal identity it can be matched to you, which is how it is used. The User Data Retention and Deletion Policy lists it.

B. Legal identity, identity-verification, recovery, and biometric information

Active membership requires legal-identity verification and required-photo same-person verification.

At the ordinary admission stage, Stripe Identity may collect and process a government-issued identity document, legal name, date of birth, a selfie or live capture, and related verification information. Stripe provides verification results and permitted verified identity outputs to Last. Last stores the permitted legal identity fields in its restricted identity system and may retain the admission selfie as the encrypted verification reference used for later 1:1 same-person checks.

Last may store or generate:

For required and later profile-photo verification, Last performs first-party 1:1 same-person comparison between the current encrypted verification reference and the photo submission. Required ordinary activation uses two camera-only required profile photos. Last does not require a randomized pose/gesture challenge for those photos and does not claim that this comparison is a liveness system. Face geometry, embeddings, landmarks, crops, or comparable transient working artifacts exist only for the in-flight job and are not retained as a reusable biometric template. Last does not perform 1:N face search, cross-account face matching, attractiveness/emotion inference, or demographic inference from face data. When you report an intimate image as depicting you, an authorized reviewer may, with your agreement in the report flow, visually compare your verification reference with that image; this is a one-to-one human check, not automated face matching.

Biometric/face processing is authorized only after a separate affirmative consent on a dedicated verification screen. It is not authorized merely by accepting the Terms of Use or this Policy. Verification is mandatory for active member access; declining required biometric processing means you cannot complete activation. The separate Biometric Consent and Retention/Destruction Schedule governs the encrypted verification reference, authorized purposes, retention, access, and destruction.

Every account-recovery event requires a fresh successful Stripe Identity verification. If you can establish at least two of the three account factors (private username, current password, and possession of the registered phone verified by SMS), recovery may proceed automatically after the fresh verified identity match. If you can establish only one or none of those factors, an authorized human reviewer may transiently compare the fresh provider-hosted recovery selfie with the account's existing verified profile-photo/reference material. Last does not retain a second persistent recovery-selfie reference solely for that comparison, and an internal identity-HMAC match alone does not authenticate the account.

A dedicated document exception may apply when genuine legal identity cannot satisfy an ordinary document-sufficiency rule. If an exception flow requires a birth certificate, the document is used only for the exception decision and is not retained afterward except under an independently applicable legal-preservation obligation. Last retains only the minimum audit record needed to document the decision and destruction of the transient document.

C. Public profile, photos, preferences, and optional profile information

We collect the information you provide to create and maintain your member profile and discovery preferences. Depending on the then-enabled product fields, this may include:

An ordinary optional field that you choose to fill in may be displayed on your profile and used for filtering, compatibility, ranking, or other Service functions as disclosed in the App. Clearing an active optional field removes it from your current production profile, subject to historical event records and previously created population aggregates.

Sexual-interest or kink selections use separate treatment. They are private by default and may have visibility or matching-use controls. Last may use them, as authorized by the then-current settings and notices, for recommendations, compatibility, safety, product analytics, regional analysis, and matching-model research even when they are not displayed to another member. Your profile fields, including hidden fields such as kink selections, also feed the public Compatibility Search counts, which never show fewer than 20 people (a result below 20 is shown only as "Fewer than 20"); turning kink matching off does not remove your kinks from those counts. A feature or mode may require a specified disclosure or use setting as a condition of entering that feature.

D. Location, market, and travel information

Last collects precise device location when required for registration, location verification, matching, market administration, safety, or another location-dependent feature. Last may also generate or store less precise location and market fields, including enabled market, locality or city, county or equivalent region, state or province, and country.

Precise coordinates are not displayed to other members. Other members may receive a broad distance or location representation rather than your exact coordinates.

If Travel Mode or another location-substitution feature is enabled, Last collects the selected destination, activation/expiration information, and related product state.

If you accept a structured scheduled date, Last requires the date-location permission disclosed in the App. Location processing for that date-specific attendance purpose is limited to the period from two hours before the authoritative scheduled start (T-2h) through 30 minutes after it (T+30m). If both participants confirm that they met by T+30m, that bilateral confirmation establishes attendance. Otherwise, Last may evaluate authenticated date-purpose location evidence against the authoritative meetup location; under the current rule, qualifying presence is within 100 meters. A location or venue change is authoritative only when accepted through the applicable server-recorded amendment flow.

If the pre-launch website interest-counter feature is enabled, the website may calculate an exact count of eligible pre-launch interest records within the applicable 100-kilometer radius. That counter is based on the website-interest dataset and is not represented as a count of active Last member accounts. The separate Website Waitlist Privacy Notice governs the underlying website submission data.

E. Messages, encrypted conversation data, and conversation metadata

User-authored private-message content is end-to-end encrypted. Last’s application servers store or relay ciphertext rather than ordinary readable message plaintext and do not possess the participant device key required to decrypt ordinary private-message content.

The decryption key needed for ordinary private-message history is held on the user's device unless an optional encrypted key-backup feature is enabled. Uninstalling Last can permanently lose message history when the required device-held key is lost, and logging into or recovering the account on another device does not itself recreate that key. An available encrypted key-backup feature may permit recovery of the key where the user has enabled and can use that feature.

Last may process server-visible conversation metadata, including:

Where the app permits server-proxied Giphy content, Last may process the request, selected media identifier, delivery metadata, or other information necessary to provide that feature. The product does not treat arbitrary local files, photos, audio files, or other user-uploaded attachments as ordinary private-message content unless a later feature expressly says otherwise.

When you file a report and choose conversation evidence, the selected evidence is decrypted on your device and submitted to Last’s restricted evidence system. The report flow may include a limited amount of surrounding context so evidence is not misleadingly cropped. Submitted evidence is readable to authorized reviewers and is no longer protected from Last by the ordinary end-to-end-encryption boundary.

F. Post-severance archive and report-window information

When an existing match/thread ends through an ordinary unmatch, report, block, Reset Account, account deletion, moderation-related system severance, or another applicable teardown, Last may provide both former participants with the same cause-neutral locked/read-only archive for 14 calendar days from the authoritative severance timestamp.

The archive may include the former conversation as decryptable by the viewing participant’s device, an archive alias, and the limited report-evidence selection interface. It does not permit new messages or reveal the cause of severance. The archive presentation may disappear after 14 days even when encrypted ciphertext remains stored for another authorized retention purpose.

If Last itself prevents an otherwise eligible former participant from accessing a still-live report filing surface, the filing period may pause and later resume. In that circumstance, Last may retain the minimum encrypted ciphertext and non-content routing information necessary to provide the resumed report-only evidence picker for the remaining filing interval.

G. Likes, discovery, matching, date, and outcome information

We collect or generate information necessary to operate discovery, matching, and outcome measurement, including:

Last maintains private internal values and rules used to operate profile ordering, admission, safety, fraud prevention, moderation, and matching. Another member does not receive your internal scores, queue position, hidden admission logic, moderation history, special account class, subscription status, or another hidden-state value through the ordinary peer interface.

H. Match Hold and moderation information

If an active match is severed because one participant enters a qualifying suspension, Last may collect the innocent participant’s choice to sever or create a Match Hold, the suspended participant’s later acceptance or decline where applicable, reservation/revocation/expiry timestamps, and the hard-eligibility state used to determine whether a later rematch may occur.

We also collect information needed to enforce the Terms, Community Guidelines, and published safety rules, including warning and strike state, qualifying moderation category, sanction start and end times, appeal filing and decision state, evidence and decision receipts, and restricted anti-evasion records.

Last’s current moderation design includes a separate terminal-safety track for qualifying scam/advertising/fraud-account/bot and underage outcomes. A final underage access sanction may last ten calendar years. Qualifying scam/advertising/fraud-account/bot sanctions may be permanent. Enforcement-related identity, phone, or device HMAC records may therefore outlive deletion of the ordinary production account for the independent lifetime of the applicable sanction or abuse-control rule, as described in Section 11.

I. Screenshot and screen-capture information

Screenshot handling varies by operating system and surface.

On Android, Last may use platform controls designed to block screenshots or screen recording where supported. A blocked capture does not necessarily create a server event.

On iOS, where equivalent blocking is unavailable, a screenshot of a matched-profile or chat surface may cause Last to create a timestamped server-readable, unencrypted system event associated with the relationship. The event may be shown to both participants. It is not user-authored message content and is not represented as end-to-end encrypted.

Last may also process certain discovery-screen capture events or counters for abuse prevention and enforcement. No software can detect or prevent every form of copying, including photographing a screen with another device.

J. Device, network, app, and diagnostic information

We collect or generate device and operating-system information, app version, push-notification tokens, login/session identifiers, device-trust information, device-integrity or attestation signals where used, IP-derived security information, rate-limit and abuse signals, crash reports, structured error records, and performance diagnostics.

For repeated-abuse controls, Last may derive and retain a keyed HMAC from the normalized phone number and a governed pseudonymous/keyed representation of a durable device identifier. These values are restricted anti-abuse signals, not ordinary peer identifiers.

On every app launch, before login or sign-up, the App requests the platform's age signal: Google Play's on Android and Apple's Declared Age Range on iOS. Last does not store the signal; only that session's allow-or-block decision is kept. Some device, security, and diagnostic information described in this section is also processed before you log in.

K. Purchases and subscriptions

Paid Android purchases are processed through Google Play Billing. Last may receive transaction identifiers, purchase token, order identifier, storefront, purchase status, price, currency, billing period, acknowledgement state, renewal/cancellation state, refund/revocation state, promotional entitlement, subscription entitlement, and related receipts. Last does not receive your full payment-card number merely because you purchase Premium through Google Play.

For a paid Premium purchase, Last also collects the email address used to deliver the contract copy and automatic-renewal acknowledgment. Last links the purchase to the authenticated account and stores the information needed to process cancellation and refund requests, including a random opaque cancellation token and the applicable cancellation-window timestamps. The statutory cancellation email address is [email protected] when that paid surface is enabled.

One-time verification payments. Where a separately disclosed identity-verification charge applies, Stripe processes that one-time payment for new-member admission verification or additional non-member identity verification associated with attribution review of an NCII report. Last uses necessary payment status and transaction/receipt information for the verification flow, payment support and required records. The statutory NCII image-removal request itself is not conditioned on payment. These payments do not purchase Premium, consumables or private messaging.

L. Support, feedback, appeals, and communications

We collect support messages, account-security communications, privacy requests, feedback, appeals, bug reports, attachments you choose to provide, and information needed to respond.

During closed Beta, the Settings Beta Feedback surface may collect free-text feedback plus limited non-content diagnostic context such as app/build version, Android/OS version, device model/class, timestamp, and the authenticated account identifier while the account exists. Beta Feedback does not silently attach ordinary E2EE message content, report evidence, profile-photo bytes, identity/biometric material, precise location, another person's protected data, or arbitrary screenshots/files.

General support routing may differ by subscription tier. Non-Premium users may receive AI-assisted support while Premium users may receive general human/non-AI support. This distinction does not remove human review from a workflow that specifically requires human adjudication, such as certain account-recovery comparisons, identity-document exceptions, moderation appeals, accessibility decisions, or other mandated reviews.

Support, Beta Feedback, and other authorized free text may be processed by Anthropic or another disclosed automated text-processing provider for specifically limited classification, routing, summarization, automated response drafting, or generation of scrubbed/derived research representations. Last removes designated direct identifiers before sending text through that route and does not intentionally provide the account’s verified phone number or precise coordinates as model inputs. Inbound email text may be processed through this route, but attachments are not sent to the model. Automated email replies identify themselves as automated, and unauthenticated email is not used to disclose account-specific personal data or make account changes. CSAM-class image material, NCII image material, identity documents, and face-reference images are not sent to Anthropic under this text-processing authorization. Free text can nevertheless contain identifying, sensitive, or third-party information that you choose to write, so do not include information unnecessary for the request.

M. Website waitlist, beta application, and beta research information

Information submitted before account creation through the website waitlist or closed-beta application is governed primarily by the Website Waitlist Privacy Notice or another collection-specific notice. Those records may include contact information, age, gender, genders sought, region, invitation or promotional-code information where enabled, the code and label of the source link a submission first came through and the time that link was opened, acknowledgment/consent records, and beta-selection or survey information.

Submitting website interest or a beta application does not itself create a Last account, create a Premium entitlement, waive verification, or guarantee admission.

N. Account-deletion exit survey

For an ordinary in-App Delete Account request, Last collects one structured exit reason: Found someone off app; Sticking with the person I matched with in Last; Don't like the app; Taking a break from the app; or Other. The "Don't like the app" and "Other" choices require a non-empty free-text explanation. The "Taking a break from the app" choice may offer Breaking instead of deletion.

The exit survey is not required for a statutory Privacy Rights Center deletion request, legally compelled deletion, or confirmed-minor deletion. An exempt deletion records a separate survey-exempt reason code rather than imputing a survey response.

The structured reason is committed only when the deletion request is actually submitted. If the account is recovered during the 60-day recovery period, Last distinguishes the requested-deletion reason from a completed hard-deletion outcome.

For a standard account that reaches hard deletion, the structured exit reason may survive as an identity-severed Delete-event/outcome label. If the reason is Sticking with the person I matched with in Last, that pair-level relationship outcome may be associated with the applicable match record and therefore may also be reflected in restricted outcome records associated with the counterpart in that match. Last does not disclose the user's raw explanation to the counterpart.

Raw deletion-survey free text is deleted at hard deletion. Only a scrubbed, redacted, or derived representation may survive in the restricted research plane. If Anthropic is used to produce that derived representation, that use is limited to the text-processing purpose described in this Policy.

O. Website visitors

Visiting the lastdating.app website does not create an account. Like any website, ours receives your device's network address (IP address) and ordinary request information, such as the page requested, the time and your browser type, when your browser loads a page. Last's website host and network security provider processes that information for Last under its own privacy terms. The homepage also loads the support chat's script from Last's support service, which runs on a server hosted by a cloud hosting provider, so that server receives your network address when the homepage loads, whether or not you open the chat. Last tracks and analyzes use of its website, as follows. When you open one of Last's source links (web addresses that begin lastdating.app/r/), the website sets a cookie in your browser that records which link you came through, and if you then join the waitlist, your submission is credited to the first source link you came through. Last counts visits through each source link and keeps totals by link, stage (a visit, a submission and an invitation sent), gender, broad region and calendar month. To limit how often one network address can open source links, the waitlist database keeps a one-way code derived from the address for up to about three hours, never the address itself. The Website Waitlist Privacy Notice describes the cookie, the counts and that code. The website host may set cookies that its security features need.

If you use the support chat, the text you type is sent, as you typed it, to that support service, and an AI service processes it to generate the reply. Do not include personal information in a chat question. While you chat, the service uses your network address to limit how many questions one address can send, and it holds the recent turns of your conversation in memory for about 30 minutes so that replies can take earlier questions into account. Last keeps a log of each exchange for about 90 days to improve its answers (entries older than 90 days are removed each day): the time, the text of your question, the length of the reply and a one-way code derived from your network address and a secret value, not the address itself. The reply text is not kept in that log unless Last turns reply logging on, in which case this Policy will say so. Because the log records nothing that identifies you apart from the words you typed, Last needs the approximate time and wording of a question to find it; write to [email protected] if you included personal information in one. The chat keeps a random session identifier in your browser's session storage so that a conversation can continue while the page is open.

Information you submit through the website waitlist form is governed by Section 2.M and the Website Waitlist Privacy Notice.

3. HOW WE COLLECT INFORMATION

We collect information:

We do not treat publicly available information from the open Internet as permission to scrape or import a person into Last. Any separate enrichment or third-party-data practice would be described in an updated notice before it begins.

4. HOW WE USE INFORMATION

We use personal information to:

We may also process information with your consent or as otherwise required or permitted by law.

5. SENSITIVE INFORMATION

Information processed by Last may include categories that can be sensitive, such as precise location, legal identity, date of birth, sex/gender, sexual orientation or genders sought, sexual-interest or kink selections, religion, income-related profile information, lifestyle information, moderation data, account-security signals, identity-verification information, and message metadata.

Last uses sensitive information for the Service, verification, security, safety, matching, analytics, research, and other purposes described in this Policy and the applicable point-of-collection notices. Under the current authorized advertising model, Last does not use precise location, legal identity, sexual orientation, sexual-interest information, religion, private-message data, hidden state, moderation information, or verification information to create personalized cross-context advertising profiles.

Some information is necessary to provide a requested feature or to maintain the Service’s verification and safety model. For example, active membership requires identity verification and local discovery requires location. Where applicable law gives you a right to limit a covered sensitive-information use, Last will honor that right as required; a feature that genuinely requires the information may become unavailable rather than using the information for an undisclosed purpose.

6. AUTOMATED PROCESSING AND INTERNAL SYSTEMS

Last uses automated rules, scoring systems, and models to operate discovery and profile ordering, manage waitlist/admission and market state, enforce product activity rules, detect fraud or abuse, identify safety risk, support moderation triage, and develop or evaluate matching systems.

The product’s published participation/conduct categories may use server-observable interaction data concerning unanswered-message bursts, missed opener/reply obligations, serial actor-initiated unmatching, sustained zero-intent pass/dislike patterns, profile completeness combined with received decisions, qualifying report or block outcomes, human-confirmed bad-faith reports, scheduled-date attendance/late cancellation, habitual delete-before-seen behavior, reply-rate performance, and successful date/Turbo outcomes. Ordinary private-message plaintext is not inspected to calculate metadata-based messaging categories.

Internal values may include compatibility, ordering, participation, conduct, safety, fraud-risk, admission, and quality measures. These internal decision values, per-event weights, thresholds, queue positions, market-supply calculations, and other implementation mechanics are not ordinarily exposed to members or peers.

Where the applicable product rule requires a human decision or confirmation, an automated system does not replace that required human adjudication. A person may also have appeal or privacy rights under the Terms, Community Guidelines, this Policy, or applicable law.

7. WHAT OTHER MEMBERS CAN AND CANNOT SEE

Other members may see the information you choose or are required to place on your public member profile, including your display name, profile photos, ordinary visible profile fields, and the broad distance/location representation the Service is designed to show.

Depending on your settings or feature choices, another member may also see permitted sexual-interest disclosures, match or conversation state, read status, date-proposal information, server-generated relationship notices, and the iOS screenshot system event described above.

Through ordinary peer surfaces, other members do not receive your:

An archived former-participant surface may use a non-unique alias and limited historical conversation information instead of the person’s current profile, specifically to reduce cause and state inference after severance.

8. HOW WE DISCLOSE INFORMATION

A. Other members

We disclose profile and relationship information to other members only through the authorized peer surfaces and visibility rules described in the Service and this Policy.

B. Service providers and processors

We disclose information to vendors or services that perform authorized functions for Last, such as:

Last may also disclose apparent child sexual exploitation and required related information to the National Center for Missing & Exploited Children (NCMEC) and disclose information to law enforcement or other authorities where required or permitted by law.

Providers receive information only for the contracted or otherwise disclosed service and are subject to applicable contractual, security, and legal restrictions. The exact provider/subprocessor list may change over time; Last keeps the provider list in this Policy current.

C. Safety, legal process, and protection of rights

We may disclose information when reasonably necessary to:

We may preserve information beyond an ordinary retention period under a narrow documented legal-preservation hold when reasonably necessary for the protected matter.

Law-enforcement and legal-process requests. Law-enforcement agencies and others serving legal process concerning Last may contact [email protected]. A request should identify the requesting agency or organization, an official reply contact, the legal authority relied upon, the account or material sought, the scope and relevant dates, and any applicable deadline; attach the relevant legal process where applicable. Last evaluates the authority, scope, jurisdiction and applicable legal restrictions before any permitted disclosure or preservation, and may request clarification or additional process. A preservation request does not, by itself, authorize disclosure of otherwise protected information. A government preservation request is honored for 90 days and may be extended once for a further 90 days where the law provides; legal process is honored until satisfied. The ordinary deletion timer continues while a legal hold is in effect, and overdue material is deleted when the hold is released. Last does not hold the decryption keys for ordinary end-to-end encrypted private messages and cannot produce their plaintext from its servers; conversation evidence that a participant voluntarily submitted with a report is handled under the report-evidence and legal-preservation rules. Whether other responsive records are available depends on Last's applicable privacy, encryption and retention practices.

Emergencies and specialized processes. This email is not an emergency dispatch channel and does not promise continuous monitoring or an immediate response; persons facing immediate danger should contact emergency services. Where the law permits, Last may make an emergency disclosure to prevent death or serious physical injury. Reports concerning child sexual exploitation, nonconsensual intimate images, copyright infringement and privacy rights use their separately published procedures; the legal-process contact does not replace those channels.

D. Business transactions

Information may be disclosed in connection with a proposed or completed merger, financing, acquisition, bankruptcy, reorganization, sale of assets, or similar business transaction, subject to applicable law and appropriate confidentiality protections.

E. Advertising disclosures and California sale/share treatment

Eligible free-tier users may receive advertising. Last discloses the platform advertising identifier to the advertising provider, and the provider's SDK may collect device information, advertising-ID information, and ad-interaction information for personalized cross-context behavioral advertising.

Under California privacy law, disclosure of the advertising identifier and related SDK data for cross-context behavioral advertising constitutes sharing and may also constitute a sale depending on the specific legal treatment and consideration involved. Last does not provide the advertising provider with a user's Last profile fields, sexual orientation, sexual-interest selections, private-message content, moderation/safety data, identity-verification material, hidden account state, or Last-derived behavioral data as targeting inputs.

Every user is offered the personalized-ad / applicable Do Not Sell or Share My Personal Information control. Where a legally recognized opt-out signal such as Global Privacy Control applies, Last processes it as required. Turning off personalized advertising changes the advertising request path; it does not necessarily remove advertising from an eligible free-tier account. Premium is ad-free while the Premium entitlement is active.

On Android, advertising-ID availability can change because of platform permission/state, user reset, deletion, or device/platform behavior. Last does not treat a missing or reset advertising identifier as permission to substitute a Last account identifier for advertising targeting.

9. END-TO-END ENCRYPTION, REPORT EVIDENCE, AND THREAD RETENTION

Private user-authored message content is end-to-end encrypted. Last may store ciphertext and non-content metadata, but ordinary message plaintext is not available to Last without a participant intentionally submitting evidence or another specifically disclosed client-side action.

For any severance of an existing match/thread, Last may provide both former participants with the same cause-neutral locked/read-only archive for exactly 14 calendar days. During that window, a former participant who retains an unused report right may use the applicable report flow to select evidence. If Last prevents access to the report surface during a still-live filing period, the affected filing time may pause and resume later.

Retention of ciphertext after the 14-day archive depends on the event:

A later rematch does not guarantee that old message plaintext can be recovered. Decryption depends on the relevant participant-held device key or an available applicable key-backup feature.

10. RETENTION WHILE AN ACCOUNT IS ACTIVE

Last retains active-account information for as long as reasonably necessary to provide and secure the Service and for the disclosed purposes, subject to more specific limits in this Policy, the User Data Retention and Deletion Policy, the Biometric Retention and Destruction Schedule, and collection-specific notices.

Examples include:

The more detailed retention schedule is maintained in the User Data Retention and Deletion Policy. If this Policy and that schedule conflict, this Policy controls.

11. ACCOUNT DELETION, HARD DELETION, AND POST-DELETION RETENTION

A. Standard 60-day deletion lifecycle

For an ordinary standard account, requesting Delete Account starts the applicable deletion lifecycle rather than an immediate total erasure.

Day 0: the profile is removed from ordinary peer surfaces, active matches are severed, applicable push/session access is revoked or restricted, and the account enters a recoverable deletion state. Former counterparts may still have the same 14-day cause-neutral archive/report opportunity described above. The Service displays the scheduled hard-deletion date.

Days 0-60: the account is not available for ordinary use. Recovery remains available only through the applicable recovery process, including fresh identity verification. Successful authorized recovery cancels the pending deletion. Deleting the app or merely logging out does not start this lifecycle.

At hard deletion after the 60-day period: the ordinary production account is permanently destroyed and cannot be restored.

Account deletion does not by itself guarantee cancellation of an app-store subscription. Last initiates an available cancellation integration or provides the applicable store cancellation path, but the app store controls the subscription unless it confirms cancellation.

B. Information deleted from the production account at standard hard deletion

Subject to legally required transaction records, independent enforcement and anti-abuse records (including any referral marker), narrow legal holds, and the filing-right carve-out below, standard hard deletion permanently deletes or destroys the production account and its direct linkage to:

No hash, keyed HMAC, encoding, or deterministic derivative of the production user identifier survives as a research-plane join key.

C. Identity-severed research retention for a standard account

After standard hard deletion, Last may retain only the approved research categories under a cryptographically random research-only identifier generated independently of the production user identifier. The production-to-research mapping is destroyed.

The approved post-deletion research categories may include:

The retained research record does not include the deleted person’s production account identifier, name, contact information, exact date of birth, exact or derived integer age, precise coordinates, photos, bio, biometric template, verification images, ordinary private-message plaintext/ciphertext, or a deterministic production-derived join key.

The identity-severed research record is not represented as anonymous. Demographic, location, preference, sexual-interest, and behavioral combinations may remain sensitive or distinctive. Access is restricted, audited, and service-role controlled. Rare combinations are generalized, bucketed, suppressed, or excluded from applicable exports or training datasets where reasonably necessary to reduce reidentification risk.

Under the current product policy, approved identity-severed research records and population aggregates do not have an automatic expiration. Applicable law or a later adopted policy may require a shorter retention period, additional generalization, restriction, or deletion.

D. Independent enforcement and anti-abuse records

Account deletion does not automatically erase an otherwise-active safety sanction or an independent phone/device abuse-control record.

The account-level identity HMAC used for ordinary account identity and recovery remains through the 60-day pending-deletion recovery period and is destroyed with the production identity mapping at hard deletion. Separately maintained sanction-registry identity HMACs may remain only for the applicable sanction lifetime. Phone and device strike/blacklist HMAC records may remain only for their applicable rolling-window or blacklist lifetime.

Under the current repeated-abuse design, only final, non-overturned qualifying scam/bot/fraud sanctions count toward the phone/device strike system. Three qualifying final sanctions across distinct verified identities within the applicable five-year window can create a five-year phone or device blacklist, subject to the extension rule in the User Data Retention and Deletion Policy. These records contain keyed/pseudonymous signals rather than plaintext legal identity, phone number, or device value and are not research-plane join keys.

If you joined Last through a referral and that referral vested, Last also keeps a referral marker: a keyed one-way code derived from your verified identity under a key used for nothing else. It contains no name, account identifier, or research identifier, is not a research join key, and is used only to prevent a later account belonging to the same person from qualifying as a referred new member again. The marker survives account deletion, except the deletion of a confirmed minor's account, and is deleted if Last permanently ends the referral program.

A final underage sanction may remain enforceable for ten calendar years. A qualifying scam/advertising/fraud-account/bot sanction may be permanent. Deletion cannot be used to shorten the independent duration of an active sanction.

For an account subject to a permanent access ban, Last may retain the original production account UUID together with the applicable sanction-registry identity HMACs and independently retained phone/device enforcement identifiers only inside the restricted enforcement plane for the life of that permanent ban. A finite sanction may retain that production UUID only for the finite sanction lifetime. This special enforcement linkage is not copied into ordinary analytics or research records and does not authorize plaintext legal identity retention merely for ban enforcement.

E. Narrow former-participant filing-right ciphertext carve-out

If hard deletion occurs while a former participant still has a live report filing right solely because Last itself paused that person’s access to the report surface, Last may retain only the minimum E2EE thread ciphertext and non-content routing metadata needed to provide the report-scoped evidence picker for the remaining resumed filing interval.

The deleting account’s auth/account mapping, profile, Last-held account keys, production-to-research mapping, and ordinary thread/profile surfaces do not survive under this exception. Last cannot decrypt the retained ciphertext. If the former participant does not file during the resumed remainder, the ciphertext is deleted when that right expires. If the person files, retention continues only as narrowly needed for the report-evidence process or another independently valid legal hold.

F. Legal preservation and statutory privacy requests

A narrow documented legal-preservation hold may delay deletion only for information reasonably necessary for the protected legal, safety, or dispute matter.

An in-app Delete Account request and a statutory privacy-rights request are not necessarily the same process. Where applicable law requires a different response deadline, deletion scope, restriction, or exception, the legal requirement controls. Last does not use the 60-day product recovery window to delay a verified statutory request beyond an applicable legal deadline.

12. RESET ACCOUNT IS NOT DELETION

Reset Account is a product-state reset, not a privacy deletion request and not a substitute for Delete Account.

A Reset may clear or restart profile fields, photos, discovery preferences, onboarding state, active matches, and current discovery/admission state as described in the App. It may leave authentication, verified identity, account-security records, subscription entitlement, enforcement history, historical analytics, applicable research data, and other records that are not part of the reset scope.

Reset is blocked while a governing suspension or ban is active. Delete Account remains available through the restricted account surface, subject to the deletion rules above. If a deletion request is submitted while a moderation appeal is pending, the product may treat the appeal as withdrawn while preserving any independently applicable sanction or safety record.

13. SECURITY

Last uses technical and organizational safeguards designed to protect information, which may include:

No technical system is perfectly secure. We cannot guarantee that unauthorized access, loss, misuse, alteration, or disclosure will never occur. You are responsible for protecting your password, registered phone number, and devices and for notifying Last if you believe your account has been compromised.

14. YOUR CHOICES AND PRIVACY RIGHTS

Depending on the feature and your account state, the Service may let you:

Depending on where you live and whether the relevant privacy law applies to Last, you may also have rights to request access to personal information, obtain information about collection and disclosure, correct inaccurate information, request deletion, obtain portability, limit certain covered sensitive-information uses, opt out of covered sale or sharing, appeal a denied privacy request, and receive non-discriminatory treatment for exercising a privacy right.

Where personalized advertising is enabled for eligible free-tier accounts, Last's disclosure of the platform advertising identifier to the advertising provider constitutes "sharing" and may constitute a "sale" under California law, as described in Section 8.E; you may opt out through the Do Not Sell or Share control, and Last honors recognized Global Privacy Control signals where required.

To submit a privacy request, use:

Privacy Rights Center (privacy requests): https://lastdating.app/privacy-rights.html

We may need to verify your identity or authority before acting on a request. An authorized agent may submit a request where permitted by law, subject to required proof of authorization and identity verification. We will respond within the time required by applicable law and will not discriminate against you for exercising an applicable privacy right.

Some information may be exempt from a request or retained where necessary for security, fraud prevention, legal compliance, exercise or defense of legal claims, another person’s rights, or another legally permitted purpose. If information is genuinely necessary to provide a feature you request, deleting or limiting that information may make the feature unavailable.

15. CHILDREN AND UNDERAGE ACCOUNTS

Last is for adults 18 and older. We do not knowingly permit anyone under 18 to use the member-facing Service.

If Last determines that an account belongs to an underage person, the account is removed from ordinary use and handled under the applicable safety, deletion, reporting, legal-preservation, and ten-year sanction rules. Ordinary profile/content information is deleted under the applicable account-deletion rules, except material that must be retained for a legitimate safety, mandatory-reporting, legal-preservation, or enforcement purpose.

16. THIRD-PARTY SERVICES AND LINKS

The Service may link to or interoperate with third-party websites, app stores, payment services, identity-verification services, communications tools, or other external services. Their independent collection and processing is governed by their own privacy policies and terms unless the service is acting solely as Last’s processor under a contract.

Review the privacy terms of a third party before providing information directly to that third party.

17. CHANGES TO THIS POLICY

We may update this Policy as the Service, providers, law, or our practices change. If a change is material, we will provide notice in the App or by another reasonable method before the change takes effect where required by law. The effective date above identifies the version of this Policy.

A materially new biometric purpose, sensitive-data use, advertising model, provider arrangement, research use, or other processing activity may require a separate point-of-collection notice, updated consent, or another legal step. We will not rely solely on silent policy editing where applicable law requires more.

18. CONTACT INFORMATION

If you have questions about this Policy or Last’s privacy practices, contact:

Elysian Studios LLC
30 N Gould St Ste R, Sheridan, WY 82801, United States
[email protected]
https://lastdating.app/privacy-rights.html

Biometric Retention and Destruction Schedule: https://lastdating.app/biometric-schedule.html
User Data Retention and Deletion Policy: https://lastdating.app/data-retention.html
Analytics and Matching-Model Notice: https://lastdating.app/analytics-notice.html
Website Waitlist Privacy Notice: https://lastdating.app/waitlist-privacy.html