Privacy Policy

Islanders is a hobby project run by Riley Zilka, an individual, in the United States (“we”, “us”), who is responsible for your personal information under this policy. You can reach us about anything here through our contact form.

When you play without an account. The nickname and colour you choose, your seat in the game, and the moves made in the game. To let you rejoin your seat after a refresh we issue a random seat token; we store only a scrambled (hashed) version of it.

When you sign in with Google. Your Google account identifier, email address, name, and profile picture link, plus when you joined and when you last signed in. We never see your Google password.

When you subscribe. Your Stripe customer and subscription identifiers, which plan you chose, its status, and when it renews or ends. Your card details and billing address are collected and stored by Stripe, not by us — the payment form is Stripe’s, and your card number never reaches our server.

Rulesets, maps and sound clips you save, which are stored against your account. A sound clip you upload is played to the players at your table.

Messages you send us through the contact form: the topic, your message, and the email address you give for a reply. If you are signed in, the message is linked to your account.

Chat. Messages and images you share in a game are passed to the other players in that game and kept in memory while the game’s room is open. We do not save chat to our database, and it is gone when the room closes or the server restarts.

Technical information. Like almost every website, our server receives your IP address and basic browser information when you connect, and may record it in logs used to keep the Service running and secure.

We do not use analytics tools, advertising, or tracking cookies, and we do not build profiles of you.

Other players in your game see your nickname, your colour, your moves, and anything you send in chat. Your hand of cards is hidden from them as the game’s rules require.

Anyone can watch finished games in replays, which show every player’s nickname and every move. Choose a nickname you are comfortable having visible. Games still in progress are not shown.

We use your information only to:

• run the game — connect you to your table, keep your seat, save and replay games;
• create and secure your account and keep you signed in;
• provide your subscription, including checking what you have access to and handling billing;
• contact you about your account or subscription, such as a failed payment or a change to these terms;
• prevent abuse, fraud and attacks, and keep the Service working;
• meet legal obligations, such as keeping payment records.

We do not sell your personal information, and we do not use it for advertising.

Where data protection laws such as the GDPR apply, we rely on: contract, to provide the game and your subscription; legitimate interests, to keep the Service secure and prevent abuse; legal obligation, to keep payment records; and consent, where we ask for it.

We share information only with services that help run Islanders, and only as much as each needs:

• Google, which handles sign-in. Your profile picture is loaded from Google’s servers when your account page is shown.
• Stripe, which processes payments. On the subscribe page, Stripe’s own code runs to protect against fraud and may collect device information; Stripe’s privacy policy covers that.
• Content hosts. Your browser loads a font file for the 3D board from GitHub. If a player shares a GIF or image link in chat, your browser loads it from wherever it is hosted (for example Giphy or Tenor). Those services see your IP address when they send the file.
• Our hosting, where the Service and its database run.

We may also disclose information if the law requires it, to protect people’s safety, or if the Service is transferred to a new owner, who would then be bound by this policy.

We use one cookie to keep you signed in once you have an account, and a second, temporary one that exists only for the few minutes a Google sign-in takes, to protect it from forgery. Both are essential to signing in, and neither is used for tracking.

We also store a few things in your browser’s local storage so the game remembers them: your nickname, the details needed to rejoin your seat, the last room you were in, whether you prefer the 2D or 3D board, and rulesets you save on this device. This never leaves your device unless you send it.

Stripe sets its own cookies on the subscribe page for fraud prevention. You can clear cookies and local storage in your browser settings at any time; you will simply be signed out and the game will forget your preferences.

• Account information — while your account exists, and deleted when you ask us to delete it.
• Sign-in sessions — until you sign out or the session expires.
• Subscription and payment records — as long as needed to provide the subscription, and afterwards for as long as tax and accounting law requires.
• Saved rulesets, maps and sound clips — until you delete them or your account.
• Finished games and replays — kept so they can be replayed, possibly indefinitely. Ask us if you want a nickname removed.
• Messages you send us — until they are dealt with and no longer needed, and always deleted along with your account.
• Chat — not stored beyond the life of the game’s room.
• Server logs — for a limited time, only as long as they are useful for security and troubleshooting.

We take reasonable steps to protect your information. For example, sign-in and seat tokens are stored only in scrambled form, and card details are handled entirely by Stripe. No system is perfectly secure, though, and we cannot guarantee the security of information sent over the internet.

Depending on where you live, you may have the right to access the personal information we hold about you, correct it, delete it, receive a copy of it, or object to or restrict how we use it.

Most of this you can do yourself, right away, on your account page: download a copy of everything stored about your account, or delete your account, which cancels any subscription and removes your account, saved rulesets and maps, and messages you sent. For anything else, such as correcting something or removing a nickname from replays, contact us through our contact form. We may need to confirm it is you. We will not treat you differently for exercising your rights.

California residents have the right to know what personal information we collect and how it is used, to request deletion or correction, and to opt out of the sale or sharing of personal information. We do not sell or share personal information for advertising.

EU and UK residents also have the right to complain to their local data protection authority. We would appreciate the chance to put things right first.

Our server is located in the United States. Google and Stripe process information in the United States and other countries. Where information leaves your country, we rely on those providers’ own safeguards for international transfers.

Islanders is not directed at children under 13, and you must be at least 13 to create an account. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us through our contact form and we will delete it.

We will update this policy when what we collect or how we use it changes, and change the date at the top. If a change is significant, we will tell account holders before it takes effect.

Riley Zilka. You can reach us through our contact form. See also our Terms of Service.