Privacy

What we do with your data

In short: we keep just what’s needed for you to have your account, play and take part in the community, and to be able to improve the game. We don’t sell it to anyone, there are no ads and you can ask for it to be deleted whenever you want. Here are the details, item by item.

What’s stored, and what each thing is for

Your account

Your email address and your password. So you can sign in, recover your account if you forget your password and receive receipts and important notices. The password is stored encrypted: nobody can read it, us included. When you choose it, your browser checks whether it has appeared in leaks from other websites: it asks a public list using the first five characters of a fingerprint of the password, never the password itself, and nothing is stored from that.
Your name or alias and your username. So people recognize you in the community.
If you sign in with Google, Google gives us your name, your email address and your Google photo. Your account is created with the name and the email address, as if you’d typed them yourself; we never see your Google password. The Google button on the sign-in and sign-up pages is loaded from Google, so Google receives the usual technical details of that connection, as with any website you visit; we don’t send it anything about you.
Your photo and your “about me”, if you add them. For your profile. They’re optional.
Whether you want to receive news. We only email you if you ticked that box, and you can change it whenever you want.
Who brought you. If you joined through a founder’s link, it’s noted, to know how many people each one has brought.
The second verification step, if you turn it on. So nobody can get into your account even if they know your password.

What you do in the community

Your topics, comments, wishes and images, with their date. To show them in the community, which is what you write them for.
Your votes. They’re stored with your account so nobody votes twice for the same thing. The website only shows the total.

If you buy a founder spot or Early Access

That you’re a founder and your number, or that you have Early Access; what you paid and when. To give you what you bought, to handle a refund and because the law requires sales to be kept on record.
The payment is handled by Stripe. Your card details go straight to Stripe and never pass through here at any point. Stripe keeps the payment details under its own privacy policy.
Your activation key. So you can activate the game.

If you write to support

The reason, your message and the email address to reply to, and your account if you’re signed in. Only to help you.

Emails

Your name, your email address, whether you’re a founder and whether you use the website in English, to email you news and alerts about the game, in your language. They’re sent through Brevo, a French company that processes them on our behalf and under contract.
Whether each email is opened and whether its link is clicked. Only to know which emails are useful and to send fewer of the ones that aren’t.
You can stop receiving them at any time from the link at the bottom of each email or in your account settings. Emails about your account and your purchase still reach you.

The game

Downloads: which version you download and when. So only buyers can download it, and to know which versions are in use.
Activation: when you activate the game, that installation is linked to your account, with its operating system, the game version and when it was activated. So your key works on up to three computers and you can see and release yours from your profile. Failed activation attempts are logged too, to stop anyone trying keys that aren’t theirs. And when it’s online, the game asks at most once a day whether its spot is still active: for that it sends the installation’s identifier and your account’s, and nothing is logged from that check.
Playing with friends: each time you host or join a game with friends, your account, your activated computer and a scrambled code made from your network (not your IP address, and it can’t be turned back into it) are logged. The network code is erased after 30 days. It’s used to spot one copied installation playing in two places at once.
How much is played: the game sends an identifier for your computer (a scrambled code made from the ID Windows gives it, which can’t be turned back into the original; it’s the same one your activation is linked to), the time played, the version and the operating system. It’s used to know how many people play, how much and with which versions, to see whether a new version makes people play less (usually a sign that something has broken) and, since the activated installation is linked to your account, to count the hours for the refund policy and to show you in your profile, only you, how much you’ve played.
Where you get stuck: when you die and from what, where on the map (rounded to ten meters) and which achievements you unlock. It’s used to find bugs, see which parts are too hard or confusing and decide what to fix first. And, from your activated computers, to show you in your profile, only you, the longest you’ve survived, what kills you and how many achievements you have.
What you’ve done: a few totals the game counts (your longest survival in days, the palm trees you’ve cut down, the fish, the hunting, how far you’ve walked, swum and sailed, the islands you’ve set foot on), with no place or time. They’re only used to show them to you in your profile, to you and nobody else.
How it runs: every five minutes of play, your graphics card model, the quality and frame cap set in Gráficos, the average frames per second, the slowest 1 % of frames and how many animals were nearby. It’s used to know on which computers the game runs slowly and what slows it down.
Reports and crashes: only if you press F8 in the game to tell us about a problem, it sends a video of the last 10 seconds of play (only the image of the game world, with no sound), what you write (if anything), what was going on in the game (where you are on the island, the time and the weather in the game, what you were doing and what you did in the last 30 seconds, like crafting, picking things up, eating or opening menus, what you’re holding and what you’re looking at and how far away it is, the game version, your computer’s operating system, processor, graphics card, memory and screen size, your graphics settings, how smoothly it’s running and whether the processor or the graphics card is holding it back, plus the game’s latest error messages) and your saved game. If the game crashes, or something fails on your graphics card (a model or texture that won’t load, an effect that won’t compile, a card error or the card being lost), it sends the error and those same details on its own, but only if you’ve said yes: it asks you once, in the main menu, and you can change it under Opciones › Datos. With that same yes, once per game version, it also measures how the game runs for a few minutes (frames per second, stutters and memory) and sends it with your computer’s details, to know which graphics cards fall short. If you say no, nothing is sent. And if the whole window closes, only the operating system, the memory and the latest messages and errors go. It goes with your activation so nobody can fill it with junk, and it stays linked to your account: whoever looks after reports sees your community name next to it (never your email), so they can ask you about it or tell you when it’s fixed. If an error mentions your Windows user folder, that part is removed before it’s saved. It’s used only to fix the game.
Apart from reports and crashes, which are linked to your account as explained above, none of this carries your name or your email address, or details of your computer beyond the operating system and the graphics card model (and, in a report, the processor, memory, screen size and graphics settings). “How much is played”, “where you get stuck”, “what you’ve done” and “how it runs” can be turned off in the game, under Opciones › Datos; when they’re off, nothing is sent.

The mobile version

If you press “Empezar” in its notice, it sends how your phone performs: the model, the system, the browser, the graphics chip, the memory, the screen, the connection type and how fast the game runs, step by step. It’s used to know which phones it works on, where it runs out of memory and what needs lightening. It doesn’t send your name or anything that says who you are.

Visits to the website

We count which pages are opened and how long they stay in front of you: the page, the site you came from (only the domain, never the full address), whether it’s a phone or a computer, the type of browser and system and its language, the country you connect from, and a random identifier that lives in the tab and disappears when you close it. To know how many different people come in a day, a mark is made from your IP address and your browser with a key that changes every day and is deleted after two days: the mark is stored, never the IP address or the browser, and it can’t recognise you from one day to the next. We also note whether your browser had been here before: it keeps only the date of your first visit, which expires after 13 months and isn’t linked to anything else. No cookies and not linked to your account. It’s used to know how many people arrive, from where, and which pages make sense and which don’t.
On top of that, the platform that serves the website counts visits by page, country and device type, also without cookies and without storing your IP address.
To show you prices in your currency, and charge you in it, the website checks which country you’re connecting from. It’s used at that moment and not stored.
As on any website, the servers briefly log technical details of each connection —the IP address, the browser and the time— for security and to be able to track down faults.

In your browser

There are no tracking or advertising cookies. What’s stored in your browser is what the website needs to work: your session, so you don’t type your password on every page; what you’ve already read in the community, to highlight what’s new; and a few preferences. The details are in the cookie policy.
Stripe sets its own cookies on its payment page, to keep payment secure.

The desktop app

It’s this same website in its own window and collects nothing more. It only checks on your computer whether the game is installed, to show you “Jugar” (play), and that never leaves your computer.

Why they can be used

Because it’s needed to give you what you ask for: your account, the community, your spot or Early Access, the downloads and the activation. It’s what you accept when you create the account or buy.
Because you chose it: news by email, the reports you send with F8 and, if you said yes in the game, crashes and how it runs. You can withdraw that whenever you want.
Because of the legitimate interest in improving the game and the website, and in protecting them: visits, playtime, where you get stuck, activation attempts and security logs. They’re data that don’t identify you by name, and the game ones can be turned off.
Because the law requires it: sales records, which have to be kept for the tax authorities.

Who is responsible

The controller of your data is the person who makes the game, working as an individual: . For anything about your data, write to info@whiteislandgame.com. The rest of the details are in the legal notice.

Who else sees them

The companies that provide the technical service: hosting for the website, the database, the accounts and the downloads. They only process them for that, on our behalf and under contract.
Stripe, to charge you, if you buy.
Brevo, to send you emails about the game.
The authorities, only if the law requires it.
The rest of the community sees what you post and your profile: name, username, photo, “about me” and badge.

They’re not sold or passed on to anyone for advertising.

Some of those services may process data outside the European Economic Area. When that happens, it’s done with the safeguards required by the General Data Protection Regulation: the European Commission’s standard contractual clauses or, in the United States, the EU-U.S. Data Privacy Framework.

How long they’re kept

Your account data and what you post: as long as you have the account. If you delete it, they’re deleted.
Purchase data: the years required by invoicing and tax law, up to six, even if you delete the account.
Your place on the email list: as long as you have the account. If you unsubscribe, only a note that you did is kept, so you don’t get any more.
Messages to support: two years, and then they’re deleted automatically.
The email you left on the waiting list: two years from the day you signed up, and then it’s deleted automatically.
Game and visit data: as long as they’re useful for improving the game and the website.
Reports and crashes: the video and the saved game, until a month after the problem has been looked at or fixed; the text and the details, as long as they’re useful for fixing the game. If you delete your account, they stay, no longer linked to it.
Technical connection logs: a short time, as set by each service for security.

What you can ask for

You can ask to see your data, correct it, delete it, restrict its use, object to its use, take it somewhere else and withdraw a permission you gave. You ask by writing to info@whiteislandgame.com and you’ll get an answer within a month at most. No automated decisions are made about you and no profiles are built to sell you anything.

If you think something hasn’t been done right, you can complain to the Spanish Data Protection Agency (aepd.es).

Deleting your account

You do it yourself, without asking anyone’s permission: go to your profile and the button is at the very bottom. Everything is deleted —account, profile, comments and photo— and it can’t be undone. If you’re a founder, your spot goes with the account, and with Early Access, the game too. Purchase data is kept for as long as the law requires. If you’d rather ask in writing, that works too: info@whiteislandgame.com.

Minors

You must be at least 14 to create an account. If you’re a parent or guardian and believe a child under 14 has given us their data, write to us and it will be deleted.

Security

The website is encrypted end to end, passwords are stored encrypted, each person can only see and change their own things and you can add a second verification step to your account. If anything ever happened to your data, you’d be told, as the law requires.

Changes to this policy

If anything important changes about what’s stored or what it’s used for, it’s announced on the website before it applies.

Last updated: November 11, 2026