Privacy policy

Last updated 26 September 2026

Who is responsible

Settletiles is run by Ben Pflugpeil. Write to support@settletiles.com about anything on this page. The postal address is in the imprint.

When you open the page

Cloudflare delivers Settletiles. Every request passes through Cloudflare, which sees your IP address, your browser and the page you ask for, and needs them to deliver the page and to keep attacks away.

The page also loads the sign-in from Clerk (clerk.settletiles.com) on every visit, so it is ready when you want it. Clerk sees your IP address and your browser as well.

Legal basis: our legitimate interest in a site that loads fast, stays safe and lets you sign in (Art. 6(1)(f) GDPR).

Your account

Sign-in runs through Clerk. When you sign up, Clerk keeps your email address and your password, if you set one. If you choose "Sign in with Google", Google tells Clerk your name, email address and profile picture. Google's own privacy policy covers what Google does with the sign-in.

With your account, our database at Supabase, on servers in London, keeps:

• your username, and the name from your Google account if you signed in with Google,
• your email address once it is verified, so you find your settler again if you sign in a different way,
• your saved islands and settings, including every move and when it was made,
• the result of every game you finish: won or not, and how many seats were at the table,
• the online tables you sat at: who played, the game itself and the scores, so everyone can come back to a table that isn't finished,
• whether your account has a role, such as premium.

Legal basis: this is the game you signed up for (Art. 6(1)(b) GDPR).

The leaderboard

Anyone can open the leaderboard, signed in or not. It lists every account that has a username: the name, how many games it finished, how many it won, and its win rates online and against the computer. If you sign in with Google, you get a made-up username first, and that one is on the board until you choose your own.

Playing online

At an online table, the other players see your username, whether you are ready, your moves and what you write in the chat. Supabase passes all of this on live, and the chat is not stored anywhere. Open tables are listed with the host's name for signed-in players who are looking for a game. While you are signed in, you count toward the number of settlers online; nothing about that is stored.

Legal basis: Art. 6(1)(b) GDPR.

The feedback quill

The quill button sends us what you write, together with what helps us find the problem: the page, the game version, your browser, screen size and language, and the state of the game or table you were at, with the players' names. If you are signed in, it carries your username. It takes no screenshot and no email address. Only the people who build the game read it.

Legal basis: our legitimate interest in fixing what you report (Art. 6(1)(f) GDPR).

Crash reports and screen recordings, only with your yes

On your first visit, a card asks whether you want to share crash reports and play data. Nothing is sent before you answer, and nothing after a no. After a yes, PostHog receives, in its EU cloud:

• crash reports: errors in the game and the messages your browser logs,
• how you play: the pages and buttons you use, how fast pages load, and events such as a finished game or a trade,
• screen recordings of your visit. Everything you type into a field is hidden.

If you are signed in, this is linked to your account id, your username and your role, never to your email address. PostHog doesn't store your IP address. It keeps an id in a cookie and in your browser's storage for up to a year, so it can tell visits apart. Some of the PostHog tools we use to find broken games in the recordings run on AI.

PostHog deletes screen recordings after 30 days. Crash reports and play data are kept as long as they help us fix and improve the game.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Take it back any time in the game settings, under General → The data; from then on nothing is sent.

What stays on your device

The game keeps what it needs in your browser: your islands and settings, your answer to the question above, a feedback note you haven't sent yet, the portrait you picked, your last online table so you can rejoin it, and an Open Sea game in progress. Clerk sets cookies that keep you signed in. None of this is used to follow you around, and none of it needs your consent, because the game can't work without it (§ 25(2) TDDDG).

Who works with the data for us

• Cloudflare, Inc., USA: delivers the site.
• Clerk, Inc., USA: sign-in and accounts.
• Supabase, Inc., USA, with our database on servers in London: accounts, saved games, the leaderboard, online tables and feedback.
• PostHog, Inc., USA, with our data in its EU cloud: crash reports and recordings, only after your yes.
• Google, only if you choose to sign in with Google.

They work on our behalf and under our instructions, except Google, which is responsible for its own sign-in. Where data reaches the USA, the transfer rests on the EU–U.S. Data Privacy Framework or on the EU Standard Contractual Clauses. The EU recognises the UK's data protection as adequate.

How long we keep it

Your account, islands, results and roles stay as long as your account does. Ask us to delete your account, and we delete it with everything linked to it; your name leaves the leaderboard. At online tables that others still play, your name stays as part of their game. Feedback is kept as long as it helps us fix the game, and we delete yours if you ask. Screen recordings go after 30 days.

Your rights

You can ask what we store about you, and have it corrected, deleted or limited. You can have it in a format another service can read, and you can object to anything we do on the basis of legitimate interest (Art. 15–18, 20 and 21 GDPR). A consent can be taken back at any time, which doesn't change what happened before. Write to support@settletiles.com. You can also complain to a data protection authority, for example the one where you live.

Changes

When the game starts doing something new with data, we update this page. The date at the top says when that last happened.