Privacy Notice

1. Who is responsible

The controller of your personal data is the provider identified at the foot of this page. For anything in this notice — a question, a request, a complaint — write to the email address in that card. We have not appointed a data protection officer; we are small enough that the address in that card reaches the person who decides.

2. What we collect, and why

Account data

If you sign in with Google: the account identifier Google gives us, your email address, your name and your profile picture. If you sign in with an email link: your email address. We use this to know whose islands are whose, to sign you in, and to write to you about your account.

Your display name

The public name shown as the author of an island you publish. It is up to 32 characters and it is the only part of your identity that is ever public — you can change it, or clear it, in the account menu at any time.

The islands you build

The terrain, track, roads, buildings, vehicles and lines of every island you save, plus its name and size. This is the game; without it there is nothing to load when you come back.

Play activity

Which days your account was active, and per-island summary figures — how many vehicles of each kind, how much has been built, when it was last saved. We use it to understand how the game is used and to run features like the island score.

Published islands

If you publish an island, its data, name, thumbnail, star count and your display name become public. Which islands you have starred is stored against your account so a star cannot be given twice.

Subscription data

If you buy PLUS: the Paddle customer and subscription identifiers, the subscription status, the current period end and which price you are on. We never receive, see or store your card number — Paddle handles the payment and holds the card.

Sign-in security data

For email sign-in we store only a one-way hash of each magic link, never the link itself, together with when it was issued, when it expires and whether it has been used. This is what makes a link usable once and unreplayable from our database.

Models and woods you make in the Creator

The 3D model files you upload, the thumbnail and simplified copy the game makes from them, their titles and settings, and the woods types you build out of the game’s tree species. On the free plan these are public and listed under your display name; Rail Island PLUS is what lets you keep a new one to yourself. The Terms explain what public and private each mean.

Feedback you send us

If you use the Feedback window in the game, we get what you wrote and — while the “Include technical details” box stays ticked — the page you were on, the island’s id, name and size, the game version, your language, your device, screen size and browser, your graphics setting, and a list of the last 40 things you did in the app. You can untick that box and send the words alone. A picture of the island is offered separately and is off unless you turn it on. The window shows you the exact block before you send it.

Technical data

Our hosting provider processes the usual request information — IP address, browser user agent, timestamps — to serve the site, keep it up and defend it against abuse. Your IP address is also what tells us which country a request came from; we keep the country and not the address.

We ask you for none of this ourselves: there is nowhere in Rail Island to type in your real name, your postal address, your phone number or your date of birth. The only name we ever hold is the one Google hands over when you sign in with it, and that one is never made public.

3. How we measure the game

We run two separate measurements, and they are not the same in what they hold. It is worth reading both descriptions rather than one: the first carries nothing about you at all, and the second is linked to your account.

Fathom Analytics — page views

Fathom Analytics is a privacy-focused, cookieless service that counts page views and a small fixed list of named events — an island was created, a lesson was opened, a tier limit was hit. It sets no cookie, stores nothing on your device, and builds no profile of you across sites. By deliberate rule, nothing identifying is ever put into one of its events: no account identifier, no email address, no island identifier, and nothing you typed. What Fathom can see is how many people did a thing, never which person did it.

Our own analytics — what people actually do

Beside it we keep a first-party record of how the game is used, in Cloudflare Analytics Engine. It is our own store, in our own Cloudflare account, and it is read back only by us, inside the game’s admin screens. Nothing about it is shared with an analytics company, and it exists to answer questions Fathom cannot: which step of building a railway people give up on, which limit sends somebody to the upgrade window, whether a lesson helps.

It works by recording each thing you do in the game as one small event, in order. An event holds what happened and a few facts about the circumstances:

What happened

the kind of event — a vehicle placed, a stretch built, an island created, published or deleted, a lesson started or finished, a sign-in step, a limit hit, an upgrade window opened, a checkout opened or closed, a screen shown — and its one main detail, such as which tool, which transport mode, which lesson or which limit.

Who it belongs to

your account identifier if you are signed in, or an identifier for the browser tab if you are not. This is the part that makes it different from Fathom, and we would rather say so than describe it as anonymous. It is our own internal identifier, never your email address and never your name.

The circumstances

the island the event happened on and its size, the language the game was in, the country our hosting provider resolved from your IP address, whether you were on a phone, a tablet or a desktop, how far into the visit it happened, and how many separate days your account has been active.

What it never holds is anything you typed. No island, station or line names, no display name, no email address, no message, no address, no card detail. Free-form details are cut to 48 characters and stripped of anything but letters, digits and a few punctuation marks before they are stored at all.

It is sampled above a certain volume, which means some events are simply never recorded, and every figure we read out of it is an estimate rather than a count. It expires by itself after about 90 days — see section 7, which also explains the one thing about it we cannot do on request.

What is stored on your device

There is no advertising, retargeting or third-party tracking anywhere on this site or in the game, and nothing here follows you to another website. So there is no cookie banner. This is the complete list of what is stored on your device, including the two items the analytics above needs:

The first three are strictly necessary for something you asked for. The last two are ours alone: they are first-party, they identify a visit rather than a person, they are used for the measurement in this section and for nothing else, and they cannot be read by anybody else or used to recognise you on another website. We rely on our legitimate interest in understanding our own game rather than on your consent for them, and you can object — see section 8.

4. Our legal bases

5. Who else processes your data

We do not sell your personal data and we do not share it for anybody else’s marketing. We use a small number of service providers to run Rail Island:

We may also disclose data where the law requires it, or to establish or defend a legal claim.

6. Where your data goes

We are based in the Czech Republic and our providers operate globally, so your data may be processed outside the European Economic Area — in the United States in particular. Where that happens, the transfer is covered by the safeguards the GDPR requires, ordinarily the European Commission’s Standard Contractual Clauses or an adequacy decision covering the provider. Ask us and we will tell you which applies to a given provider.

7. How long we keep it

Your account and islands

for as long as your account exists. Delete an island and it goes; ask us to delete your account and the rest goes with it.

Published islands

until you unpublish them or delete your account.

Magic links

the hash of a link is unusable after 15 minutes and is cleared out in the ordinary course.

Subscription and payment records

for as long as the law requires us to keep records of a sale for tax and accounting purposes, which outlives the account itself. This is the one category we cannot delete on request.

Models and woods you uploaded

until you delete them, or your account. Unlisting one takes it out of the Community library but keeps the file, so islands already built on it still draw it; deleting removes the file.

Feedback reports

for as long as the issue is useful to us, and no longer than we need to act on it.

Fathom analytics

aggregate only, with nothing in it that can be traced back to you.

Our own analytics

about 90 days, after which each event expires by itself and there is nothing left to read. This is the one place we cannot honour a deletion request: the store has no facility for deleting individual records, so closing your account does not purge the events already recorded against it — they run out their 90 days and go. Nothing in them is your name, your email address or anything you typed, and after 90 days nothing in them is anything at all.

8. Your rights

Under the GDPR you have the right to ask us for a copy of your personal data, to have it corrected, to have it deleted, to have our processing of it restricted, to receive it in a portable form, and to object to processing we carry out on the basis of our legitimate interests. Where we ever rely on your consent, you can withdraw it at any time.

Some of this you can do yourself, without asking: change or clear your display name in the account menu, delete an island, unpublish a published one, delete an uploaded model or woods type, export any island as a ZIP file, and cancel a subscription through Paddle’s customer portal.

For anything else — a copy of your data, or deletion of your account — email us from the address your account uses. We answer within one month. Deletion removes your account record, your islands, your published islands, your uploaded models and woods types, and your display name. Two things it cannot remove: the payment records described above, which we are required to keep, and the analytics events described in section 7, which expire on their own within about 90 days.

If you think we have handled your data badly, please tell us first. You also have the right to complain to a supervisory authority — for us that is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.gov.cz), and you may instead complain to the authority in the EU country where you live.

9. Children

Rail Island is suitable for children, but an account requires you to be at least 13 years old, and under-18s need a parent’s or guardian’s permission. We do not knowingly collect data from a child under 13. If you are a parent or guardian and believe your child has given us data, write to us and we will delete the account and everything in it.

Because a published island shows a display name to the whole internet, we ask younger players in particular not to use their real full name as a display name — the default we generate never uses more than a first name for that reason.

10. How we protect it

Everything travels over HTTPS. Sessions are cryptographically signed and held in a cookie that JavaScript cannot read. Sign-in links are stored only as one-way hashes and can be redeemed exactly once. Each account’s stored files sit behind a per-account prefix that a request cannot escape. Payment notifications from Paddle are rejected unless their signature verifies. No system is perfectly secure, but these are the parts that most often go wrong, and they are the parts we have deliberately built to fail closed.

11. Changes to this notice

We will update this notice when what we do with data changes. The date at the top of the page tells you which version you are reading, and we will tell account holders about a significant change by email or in the game.

12. Language

This notice is published in English only, and the English text is the authoritative one. A translation you make yourself is for convenience and has no legal effect.