Privacy Policy: Last Cup Standing: Idle Tea Defense

Last updated: October 18, 2026

Last Cup Standing: Idle Tea Defense ("the game") is made by Plenteaful. You can play without a member account. Your gameplay progress is saved on your device. Optional features include rewarded ads, in-app purchases, platform leaderboards, and member accounts for support mail and gifts.

This policy covers optional member accounts, mail and Customer service. Email-code sign-in and account-deletion controls are included in member-enabled beta builds; some earlier beta versions may not show them. You can use Customer service in a browser regardless of your app version or whether the game is installed.

What stays on your device

Your upgrades, currencies, saved battle, achievements, purchase-delivery records, local inbox, and sound and vibration settings are saved on your device. The game also keeps a small local history of ad and purchase status codes to help diagnose problems; it does not automatically upload that history.

Linking a member account keeps your existing save. It stores the account and installation identifiers, a local recovery copy of your save, and member-gift delivery receipts on the device. Member accounts are not a cloud backup or cross-device progress sync. During the beta, contact support before moving linked progress to another installation. Uninstalling the game may remove your local progress and does not delete your online accounts or service records.

Optional member accounts, mail and support (Supabase)

If you use member services or the website's Customer service, we use Supabase to host authentication and our support database. These services process:

• your email address, account identifier (Member ID), and account creation/sign-in information;
• sign-in and account-confirmation requests, including the email verification code you enter; if you choose an existing password sign-in, Supabase stores that password as a hash rather than readable text;
• a randomly generated installation identifier that associates member-gift delivery with your linked save;
• support messages sent to your member inbox, their recipients and dates, gifts and claim receipts, and cumulative amounts of gifts delivered;
• customer-service requests you submit in the game or on the website, their topics, message contents, replies, status and dates, and the account associated with each request;
• account restrictions, leaderboard-eligibility flags, moderation reasons, and records of operator actions;
• authentication and request logs, which can include timestamps, account identifiers, IP addresses, and browser or device request information.

We use these records to sign you in, deliver support messages and gifts, prevent repeated gift delivery, investigate problems, and enforce online-service restrictions. The server's gift record is not a copy of your complete currency balances or gameplay save. Your email and member inbox are not public leaderboards or player chat.

Native sign-in sessions are stored using the device's secure storage. Website Customer service sign-in tokens are held only in the current page's memory, not in browser storage, cookies or URLs; refreshing or closing that page requires signing in again. The game does not save your entered password in its gameplay save. Please do not send passwords or verification codes in support messages. Supabase privacy information.

If you use Customer service, we receive the information associated with your signed-in account and whatever information you include in your request, such as your Member ID or a description of a problem. We use this information to investigate and respond to your request. Replies can be read in the website's request view and, where member mail is available to your account, the game's Inbox. Send only what is needed, and never include passwords, sign-in codes or authenticator codes.

Account emails (Resend)

When you request an email code, Supabase sends the account email through Resend using our auth.plenteaful.com sending domain. Resend processes the recipient and sender addresses, email contents including the sign-in code, and delivery information such as timestamps, status and service logs. We use this to confirm account ownership, sign you in and investigate delivery failures. Requesting a sign-in code does not subscribe you to marketing emails. Resend privacy policy.

The email-code option in the game or website Customer service creates an account on your first sign-in when you choose that option; you do not need to create a game password. A member profile is created when you use member or support services. Linking the account to a local save is a separate step; website sign-in does not link or restore a game save. Recovery for an already linked save requires its original account. A different signed-in identity does not establish ownership of the original account or restore a cloud copy of your progress.

Ads (Google AdMob)

You can choose to watch an ad for the reward described by the game, such as sugar or a coin boost. Ads are shown only after you choose the ad option. The advertising SDK can contact Google to check consent and prepare an ad before you choose to watch it. To provide and measure ads, Google AdMob may collect:

• device or app identifiers, including the advertising identifier where permitted (on iPhone and iPad, access to the advertising identifier requires your tracking permission),
• your IP address and the approximate location derived from it,
• device and app information, ads shown, and how you interact with ads or the app,
• crash and performance information used by the advertising service.

The game uses Google's consent form where required and offers Settings → Ad privacy when Google's privacy-options form is available. On iPhone or iPad, tracking permission can also be changed under Settings → Privacy & Security → Tracking. How Google uses this data.

Buying No ads in the Tea shop gives you every ad reward without watching an ad.

Versions through 1.0.1 do not request Apple's tracking permission. Beginning with iPhone and iPad version 1.0.2, the optional TikTok ad-measurement choice below can request that permission. Google's non-personalized-ad settings remain in effect.

Optional advertising measurement (TikTok)

Beginning with iPhone and iPad version 1.0.2, players who confirm they are 18 or older can optionally allow TikTok advertising measurement. This helps us understand whether our advertisements lead to installations and app opens. The game also asks for Apple's separate tracking permission. TikTok's SDK does not initialize unless both permissions are granted. Declining does not affect gameplay, rewards, purchases, support or leaderboards. The game does not collect a date of birth for this choice.

When enabled, TikTok receives install and app-open events and their timestamps; advertising, vendor, SDK-generated anonymous and session identifiers; IP address and information that can be used to infer approximate location; app version, operating system, device model, language and user-agent information; the tracking-permission state; and SDK crash, performance and other technical diagnostics. TikTok can link these signals with its advertising data for attribution and advertising measurement. Apple's SKAdNetwork can also provide advertising-attribution postbacks subject to Apple's privacy protections.

We do not pass member email addresses, Member IDs, support messages, saved battles, currency balances or purchase transactions to TikTok. Automatic purchase reporting, automatic enhanced interaction capture and retention-event reporting are disabled in this integration.

Use Settings > Ad measurement in the game to turn this measurement off. You can also withdraw Apple's tracking permission in iPhone Settings > Privacy & Security > Tracking. Withdrawal stops future TikTok SDK requests from the game, including configuration and diagnostic requests. Reopen the game before enabling measurement again. Withdrawal does not undo data already transmitted. TikTok retains and processes previously received data under its applicable privacy and business-data terms; we do not represent those retention periods as a fixed duration. Contact hello@plenteaful.com about a privacy or deletion request, and see TikTok's privacy policy at https://www.tiktok.com/legal/page/us/privacy-policy/en.

Optional advertising measurement through Airbridge

This section applies to upcoming iPhone/iPad version 1.0.4, which has not yet been released.

Beginning with iPhone/iPad version 1.0.4, optional ad measurement uses Airbridge, which forwards permitted install and app-open activity to TikTok. The game asks for a fresh choice naming both services. This choice is available to players 18 or older and also requires Apple's separate tracking permission. Declining does not affect gameplay, rewards, purchases, support or leaderboards. We do not collect a date of birth for this choice.

When permitted, the SDK processes install/open activity and timestamps, advertising and vendor identifiers, anonymous SDK/session identifiers, IP address, device and operating-system information, app version, locale and technical SDK diagnostics for advertising attribution and measurement. TikTok may associate the permitted postbacks with its advertising data. Apple's SKAdNetwork may supply attribution reports under Apple's privacy protections.

We do not send member emails, Member IDs, support messages, saved battles, currency balances or purchase transactions to Airbridge or TikTok in this integration. No purchase/revenue event mapping is configured.

You can turn measurement off in Settings > Ad measurement, or withdraw Apple's tracking permission in iPhone Settings > Privacy & Security > Tracking. Withdrawal stops future SDK collection and transmission; it does not undo data already sent. Reopen the game before enabling it again. Retention of previously received data is governed by the services' applicable policies; we do not claim a fixed retention period. Contact hello@plenteaful.com for privacy requests.

Airbridge privacy policy.

Purchases (App Store, Google Play and RevenueCat)

Purchases are processed by Apple or Google. The game does not receive your card number or payment-account password. RevenueCat receives its generated customer identifier and purchase information, including products, transaction records and purchase access, to confirm purchases, restore eligible purchases, and provide purchase reporting.

The member-account feature does not currently replace RevenueCat's generated customer identity with your Member ID or send your member email to RevenueCat. The member database does not currently receive an automated feed of purchase or refund events. Store purchase records remain with Apple or Google and RevenueCat under their policies. RevenueCat privacy policy.

Leaderboards (Game Center and Google Play Games)

If you are signed in to Game Center (Apple) or Google Play Games (Android), the game can send your best wave and weekly Brew-off score to that service, where scores are shown with your gamer name. If you are not signed in to the platform's game service, the game does not submit scores to it.

For a linked member account, the game also checks its online-service status before submitting new scores. Scores are still handled by Apple or Google; member linking does not upload your complete saved battle to our database or automatically remove an existing platform leaderboard entry. Apple privacy policy and Google privacy policy.

Children

The game is not directed at children under 13, and we do not knowingly collect personal information from children.

Your choices

You can play without a member account, without watching ads, without buying anything, and without signing in to Game Center or Google Play Games. Sign out of member services through the game's Account screen. Signing out keeps your local progress and does not delete your member account or its support records.

In a member-enabled beta build, use Settings → Account → Delete member account to permanently remove your optional member login and its associated game-service records. We require recent email-code or password verification and explicit confirmation. Deletion is available to a verified account owner even if their online service access is suspended or they have reinstalled the game. Administrative operator accounts need a separate ownership handover through support.

To request access to, correction of or deletion of member-account information without the app, open Customer service in a browser and sign in with the account whose information you want us to review. Choose Account or data request and include your Member ID if known; it is not required. If you cannot access the original email, sign in using an email you can access and explain this in your request. That different identity does not establish ownership of the original account. We verify ownership before acting and explain what is still needed. Submitting a support request does not itself delete an account. Never send a password, sign-in code or authenticator code in a support message. See the account-deletion request page for the steps.

Deleting a member account removes its login, linked installation record, directed member inbox messages, customer-service tickets and their replies associated with that account, server gift wallet and claim history, associated moderation records, and managed service scores. You cannot sign in to read that account's tickets after deletion. Associated purchase-event data in our member-service database is removed or stripped of the deleted account's data; this is separate from store billing records. Other players' messages and purchases are preserved. The current member service does not receive a live automated RevenueCat purchase/refund feed.

Your local gameplay progress, currencies and Apple/Google purchases remain. Account deletion does not refund purchases, cancel a subscription, delete your Apple/Google account, or automatically remove existing Game Center/Google Play Games scores. Use the applicable platform's account, purchase or subscription controls for those actions. Deleting the app, clearing a save, signing out or suspending an account is not member-account deletion.

Record retention

While a member account exists, account, mail, customer-service ticket and reply, gift-claim and moderation records remain in the service; this beta has no automatic age-based cleanup. This lets support investigate delivery disputes and prevents a previously claimed gift from being treated as new. Expired inbox messages and closed support requests do not automatically disappear after a fixed number of days.

After confirmed account deletion, two small security records remain:

• A cryptographic hash of a random deletion-confirmation token and the deletion timestamp. This receipt does not store your email or Member ID. It lets the app confirm successful deletion after an interrupted connection, even after your login is gone.
• A separate cryptographic hash of the deleted Member ID, used to block stale account recreation and delayed purchase events. This is a pseudonymous security record, not a claim of complete anonymity. It contains no email or readable Member ID and is not linked to the deletion receipt.

These security records currently have no automatic expiry. We retain them to prevent account or gift records being recreated and to resolve interrupted deletions. On the device, the app keeps a pending deletion token until it can confirm the server result and finish removing local member-linking records. An interrupted request is not reported as completed merely because sign-in fails.

Supabase, Resend, Apple, Google and RevenueCat also maintain their own operational, authentication, email-delivery or purchase records and backups under their policies and settings. Deleting the live member account does not automatically erase those provider records, copies in backups, or support-email correspondence. Their retention periods are not represented here as a fixed number of days. Contact us about a specific data-removal request and we will explain the records involved and any applicable retention constraints.

Changes

When these practices change, we will update this policy and its "Last updated" date. New account features, email delivery or purchase-account linking may require further updates.

Contact

Questions about this policy or the game: Customer service.