Suomeksi

Privacy Policy

Last updated 21 August 2026

In short: Island Tycoon is an idle game that runs in your browser. You can play it from start to finish without any data leaving your device — by default your progress is saved only in your own browser.

Data is sent to the server only if you choose to join the leaderboard or sign in with Google. The game uses no visitor tracking or analytics, and no data is sold or shared for marketing purposes.

1. Data controller

Kalermo Topi Aaro, a sole trader registered in Finland
Business ID (Y-tunnus): 3171387-1
Email: topidowork@gmail.com
Service: Island Tycoon, playislandtycoon.com

You can contact us by email about anything concerning this policy or your own data.

2. What data is processed

2.1 Data stored on your device

This data stays in your browser and is not sent anywhere unless you separately enable one of the optional features described below.

Game save

Coins, buildings, upgrades, achievements, prestige runs, settings, and daily-bonus and rewarded-ad dates.

Where: IndexedDB, key saarivaltio-save

Purpose: preserving your progress

Random device token

Where: localStorage, saarivaltio_lb_token

Purpose: proof that a leaderboard entry is yours. Created only if you enable the leaderboard.

Cloud-save flag

Where: localStorage, saarivaltio_cloud_linked

Purpose: tells the game whether your save needs backing up

Dismissed install prompt flag

Where: localStorage

Purpose: prevents showing the same prompt again

You can delete all of this by clearing site data in your browser settings, or with the Reset game action in the game's settings.

2.2 Leaderboard (optional)

The leaderboard is off by default. If you turn it on in the game's settings, the following is stored on the server:

A random player identifier (a UUID generated by your device) — it contains nothing that refers to you
A hash of your device token (SHA-256) to verify ownership — the token itself is never stored
The nickname you choose — shown publicly on the leaderboard
A country code (e.g. FI) derived by Cloudflare from your connection — shown publicly as a flag. Country only, no finer location.
Your scores and timestamps

The nickname is entirely your choice. We recommend not using your real name, since it is visible to all players.

2.3 Google sign-in and cloud save (optional)

You may sign in with a Google account so your save carries over between devices. Sign-in is handled by Firebase Authentication (Google).

The server stores your Firebase user identifier (a random string) and your game save.
Your email address is not stored on the server. It is verified during sign-in and shown back to you in the game's settings, but it is never written to the database.
Alongside the save, total earnings and playtime are stored so the game can tell which save is newer when the same account is used on two devices.
Google processes the sign-in itself under its own privacy policy.

2.4 Technical data

The game is hosted on Cloudflare's network. Cloudflare processes your IP address to deliver the pages and to prevent abuse (rate limiting). The IP address is not stored in the game's database and is not linked to your player identifier.

The game uses no visitor tracking, analytics, or advertising identifiers. It also loads no third-party fonts or scripts — every file comes from the same origin.

3. Advertising

Status as of 21 August 2026: the game does not show real ads. It contains two optional rewarded-ad placements, but for now they play a placeholder that loads no third-party code and sets no cookies.

When advertising is enabled, it will be implemented with Google AdSense H5 Games Ads, and the following will apply:

Ads are always optional rewarded ads: you watch one only if you choose to, in exchange for an in-game bonus. The game shows no ads you did not start yourself, and skipping an ad never blocks play.
Google and its partners may use cookies to serve ads based on your prior visits to this and other websites.
You can opt out of personalised advertising in Google's ad settings. For other advertising vendors, see aboutads.info/choices.
More about how Google handles data on partner sites: policies.google.com/technologies/partner-sites.
If you are in the EEA, the UK or Switzerland, you will be asked for consent before any ad script loads. You can change your choice at any time through the consent dialog.

This policy will be updated before ad serving begins.

4. Cookies

The game itself sets no cookies. It uses the browser's localStorage and IndexedDB (section 2.1), which is a different technology from cookies and does not follow you to other sites.

Google sign-in sets Google's own cookies, and once advertising is enabled, advertising cookies will be set as well (section 3).

5. Legal basis for processing

Performance of a contract (GDPR Art. 6(1)(b)): processing your game save and cloud save so the feature you asked for works.
Legitimate interests (Art. 6(1)(f)): preventing abuse and cheated scores, and keeping the service running.
Consent (Art. 6(1)(a)): joining the leaderboard, Google sign-in and — once enabled — personalised advertising. You may withdraw consent at any time.

6. Sharing and international transfers

Data is not sold and is not shared for marketing purposes. The following providers are used to run the service:

Cloudflare, Inc. — hosting and database (privacy policy)
Google Ireland Ltd. / Google LLC — Firebase Authentication and, later, AdSense (privacy policy)

Processing may partly take place outside the EU. Such transfers rely on the European Commission's Standard Contractual Clauses or another safeguard under Chapter V of the GDPR, in accordance with the relevant provider's terms.

7. Retention

Data on your device: until you clear your browser data or reset the game.
Leaderboard and cloud-save data: until you delete it yourself (section 8) — it is not otherwise expired automatically.

8. Your rights and how to use them

You have the right to access your data, rectify it, erase it, restrict or object to processing, and to data portability. In practice:

Delete leaderboard and cloud data: Remove me from the leaderboard in the game's settings. This permanently deletes your player record, scores and cloud save from the server.
Get a copy of your data: Export save in the game's settings gives you your entire save as text, which can be imported into another browser.
Delete local data: Reset game in the game's settings, or clear site data in your browser.
Anything else: email topidowork@gmail.com. We respond within one month at the latest.

If you believe your data has been handled unlawfully, you may lodge a complaint with a supervisory authority. In Finland this is the Office of the Data Protection Ombudsman.

9. Children

The game is not directed at children under 13, and no data is knowingly collected from children under 13. If you notice that your child has submitted data to the leaderboard, contact us and we will delete it.

10. Security

All traffic is encrypted (HTTPS). As little as possible is stored on the server: only a cryptographic hash of your device token is kept, and no email address is stored at all. No online service is completely secure, however, so absolute security cannot be guaranteed.

11. Changes to this policy

This policy is updated when the game changes — in particular before advertising is enabled. The date of the latest change is shown at the top of the page. Significant changes will be announced in the game.