Privacy notice
Last updated 11 October 2026
Calder Isles is a free online game you play in your browser. This notice says what it collects about you, why, who else sees it, how long it is kept, and what you can ask for. The short version: no real name, no payment details, no advertising, no analytics and no tracking cookies. To play, you need only a guest account the game makes for you.
Who is responsible
Calder Isles is run by Douglas Karlstedt, a private individual in Sweden, who is the data controller under the EU General Data Protection Regulation (GDPR). Write to privacy@calderisles.com about anything in this notice, and to hello@calderisles.com about anything else.
What we collect and why
Your account
- Guest account. When you first enter the world, we create an account for you with an id and the time it was made. Your browser keeps a sign-in key so it can bring you back; we keep only a protected copy of it, with when it was made and last used.
- Email and password, if you add them. If you choose to protect your account with an email address, we store the address and your password in protected form, never as written. We use it only for your account (for example, to confirm the address or help you back in); there is no newsletter and no marketing. If you turn on two-step sign-in, we store the secret your authenticator app uses.
Why: to run your account and let you back in (performing our agreement with you, GDPR article 6(1)(b)).
Your characters and play
Character names, appearance, position, skills, inventory, quests, boats, bank, trades on the market, companies, friends and ignore lists, and time played. Item and coin movements are logged so that cheating, duplication and theft can be traced and undone.
Why: this is the game itself (article 6(1)(b)), and keeping the economy fair for everyone (our legitimate interest, article 6(1)(f)).
Chat and reports
Chat is not saved. The game holds the most recent lines briefly in memory, and they are gone when it restarts. When someone uses /report, or the chat filter blocks repeated abusive messages, we save the report with the names of both players, the reason, and up to 40 recent lines of chat between or from them, including private whispers between the two. Mutes and bans are saved against the account.
Why: keeping the game safe and dealing with harassment (legitimate interest, article 6(1)(f)).
Bug reports
When you send /bug, we receive what you write and, to help us fix it: a picture of the game world (not your chat or menus), your character name, account id and position, your browser and graphics card, screen size, frame rate, connection quality and recent error messages from the game. The report is kept privately by us and in our private bug tracker.
Why: fixing the game (legitimate interest, article 6(1)(f)). Only send it if you are happy for us to have this.
Ideas
When you send /idea, we receive what you write, your character name, account id and position, and the game's version. Nothing about your device and no picture. It is kept privately by us and in our private bug tracker.
Why: planning the game with its players (legitimate interest, article 6(1)(f)).
Network and security data
- Your IP address is used, in memory, to limit how fast one connection can make accounts, sign in or send reports, and to spot one person running many accounts at once. If four or more accounts play from the same address at the same time, a moderator is told which accounts they are, without the address itself being saved.
- When a new guest account is made, our security provider may check in your browser that you are a person, not a bot. The check's answer, and possibly your IP address, go to that provider.
- The game's own logs record events such as character names on deaths and zone changes. They do not record IP addresses or emails.
Why: protecting the game and its players from abuse and bots (legitimate interest, article 6(1)(f)).
In your browser
The game saves your settings, your sign-in key and copies of your characters' progress in your browser's storage. These stay on your device and are not used for advertising or tracking. Clearing your browser's site data removes them (and, for a guest account without an email, your way back in). We set no cookies ourselves; our security provider may set strictly necessary security cookies to tell people from bots.
Who else sees it
We do not sell your data and we share it with no advertisers. These services handle it for us:
- Our hosting provider, in the EU: runs the game and keeps its data and backups, in Finland.
- Our network and security provider: carries traffic to the website and the game, serves the website, runs the bot check, and forwards email sent to our addresses.
- Our bug tracker: keeps bug reports and ideas in a private project.
Your browser loads the website and the game, lettering included, from us; the only part it loads from another company is the bot check, when it runs. The network provider and the bug tracker may handle data in the United States, and both are certified under the EU–US Data Privacy Framework, which the European Commission recognises as giving adequate protection. Write to us if you want the names of these providers.
How long we keep it
- Accounts and characters: for as long as the account exists, or until you ask us to delete it. A guest sign-in lasts 400 days from last use; an email sign-in, 30 days.
- Ended sign-ins: deleted 30 days after they expire or you sign out.
- Item and coin movement log: 90 days. Completed market trades: 180 days. Your open and past market orders: as long as your account exists.
- Bug reports and ideas: screenshots are deleted after 180 days, and the rest after a year. Copies in the bug tracker stay until we delete them.
- Moderation reports: a year after they are made, once dealt with. The moderation log: a year. Mutes and bans: a year after they end; a permanent ban is kept while it stands.
- The game's logs: overwritten as they fill up, usually within days.
- Backups: about a month (daily copies for a week, weekly copies for four weeks).
Your rights
You can ask us for a copy of the data we hold about you, to correct it, to delete it, to limit what we do with it, or to give it to you in a form you can take elsewhere. You can object to anything we do on the basis of legitimate interest. Write to privacy@calderisles.com from the email on your account, or, for a guest account, tell us your character name and we will ask you to prove it is yours in game. We answer within one month. Deleting an account removes it, its characters and everything tied to them, including your reports, bug reports, ideas and chat lines saved in other players' reports; market trades with other players stay with your side made anonymous. Copies in backups are overwritten within about five weeks, and we delete the copies in the bug tracker.
If you are unhappy with how we handle your data, you can complain to the Swedish Authority for Privacy Protection (IMY) or the data protection authority where you live.
Children
Calder Isles is not meant for children under 13. If you are under 13, please do not play. If you believe a child under 13 has an account, write to us and we will delete it.
Changes
If we change what we collect or how we use it, we will update this page and its date, and say so in the News on calderisles.com when the change matters.