Effective September 13, 2026

Privacy Policy

Your account keeps your islands together. This page explains the information used to make that work.

Settlecoast is operated by DESIGNCODE IO PTE. LTD., Singapore. For privacy questions or requests, email shadownessguy@gmail.com and mention Settlecoast.

Information we use

• Account information: your email address, account identifier, sign-in method, and authentication records. If you choose Google sign-in, Google shares your account identifier, email address, name, and profile picture with our authentication provider, Supabase. We use this information to create and authenticate your Settlecoast account.
• Saved games: islands, game progress, save names, and timestamps that you choose to back up to your account. Local saves and preferences are also stored in your browser.
• Online games: player names, profile picture URLs, room identifiers, game actions, and game state needed to run a match. When available, your Google name and profile picture appear to other players at your table. Photos load from Google's image service; guests and players without a photo use the game's default portraits. Your account email and private sign-in information are not shared with other players.
• Technical information: service logs, IP addresses, browser information, and request timestamps processed by our hosting and authentication providers to operate and secure the game. Our operational logs also record request counts, response sizes, service calls, and AI token usage. We group these records using account or guest-seat pseudonyms that change daily, without including email addresses, sign-in tokens, chat messages, or saved-game content in these usage records.
• Support and billing: information you send when contacting us. If purchases become available, Stripe processes payment details; Settlecoast stores billing identifiers and membership status, not complete card numbers.

Google sign-in

Google access is limited to basic identity, email, and profile information. Settlecoast does not request access to your Gmail messages, Drive files, contacts, or calendar. We do not sell Google user data, use it for advertising, or use it to train AI models. Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

How information is shared

Supabase provides authentication and database services. Resend delivers account emails. Netlify provides web hosting. These providers process the information needed to deliver their services. Google handles Google sign-in, and Stripe handles payments when enabled. Information may be processed outside your country; Settlecoast's primary Supabase database is in Singapore. We may also disclose information when required by law or necessary to investigate abuse and protect the service.

AI strategy reviews

When you request a coach review, our server sends your visible board position, your own cards, and calculated production statistics to OpenAI to generate advice. We exclude player names, account details, opponent hands, game seeds, and the future deck. We request that responses are not stored as API application state; OpenAI may retain data for abuse monitoring under its API data policies. Completed advice is stored with your account in Supabase so retries do not consume another review. API credentials never enter the browser. See OpenAI’s Privacy Policy.

Optional analytics

Google Analytics measures visits, general device and browser information, referral websites, engagement, local game starts, and views of the upgrade screen. This applies to visitors and free or paid players alike, without linking reports to an account. Google processes this technical information to provide reports; it may process data outside Singapore. Analytics uses first-party cookies to recognize a browser across visits, with a configured lifetime of 180 days. We do not send account identifiers, email addresses, player or save names, room codes, authentication tokens, or saved-game contents to Analytics.

Analytics is on by default outside the European Economic Area, United Kingdom, and Switzerland, unless you have opted out. In those regions, or when we cannot determine the applicable setting, analytics stays off until you choose “Allow analytics.” We use country information provided by our hosting service to select this default; the privacy-options response contains only the setting, and we do not store that country in an account or send it as an event parameter.

You can turn analytics off in one click from the welcome screen or account privacy choices, or from Settings → More → Your privacy choices. Your opt-out remains saved in this browser until you change it or clear browser storage. Earlier opt-outs are honored. An explicit opt-in is remembered for up to 180 days. If browser storage is unavailable, analytics stays off unless you choose to allow it for the current page. Turning analytics off stops further collection and removes its cookies from this site; it does not erase information already collected. We honor browser Global Privacy Control and Do Not Track requests. Google advertising signals, ad personalization, and automatic form and link measurement are disabled. See Google's Privacy Policy for Google's processing practices.

Storage and protection

Authentication sessions and local games use browser storage. Signing out removes the session from that device; it does not delete local games or cloud backups. Cloud-save access is restricted to the signed-in account, and hosted connections use HTTPS. No online service can guarantee complete security.

Account information and cloud saves are retained while your account is in use, unless you request deletion. Operational logs and backups follow the relevant provider's retention settings. We may retain records needed for legal, accounting, security, or dispute-resolution purposes.

Your choices

A confirmed account is required to play. You can read the Rulebook without signing in, choose which islands to back up, sign out, or clear local game data through your browser. You can revoke Google access in your Google Account connections. Revoking Google access does not itself delete your Settlecoast account or saves.

To request access, correction, or deletion of account information and cloud saves, contact shadownessguy@gmail.com. We may ask you to verify ownership before completing a request. Deleting cloud saves can permanently remove progress that is not also stored on your device.

Changes to this policy

We will update this page when the service or its data practices change. The effective date above identifies the current version.