Privacy Policy
As of 10 October 2026 · Wrecklanders: Idle Island · The German version is legally binding: Datenschutzerklärung
Wrecklanders: Idle Island is a free game. It runs in the browser (web version at wrecklanders.com) and, from version 1.0, as an Android app. The web version shows no ads (yet), uses no third-party trackers and needs no sign-up with name or e-mail. Sections 1 to 7 apply to the web version and the app. What the app adds (optional ad videos, notifications) is described in section 8. This page explains which data is processed, where it is stored and how you can delete it.
1. Controller
Simon Streblow
Quintenzstraße 1
77723 Gengenbach
Germany
E-mail: simonstreblow@googlemail.com
2. What we store
| Data | Where | Purpose / legal basis | How long |
|---|---|---|---|
| Game progress, settings (sound, statistics yes/no, language), a friend's invite code | Your browser's local storage | So the game works (§ 25(2) TDDDG, Art. 6(1)(b) GDPR) | Until you delete it |
| Pseudonymous player account (random ID, without name, e-mail or password), cloud save, island name, invite code, friendships, help between friends, a random device ID (so only one device plays at a time) | Supabase (data centre in Frankfurt am Main, Germany) | Saving progress, playing on several devices, friend features (Art. 6(1)(b) GDPR) | Your account and cloud save are deleted after 30 days without activity if you have never opened a bag; otherwise after 12 months without activity since your last play. You can choose “Delete all my data” at any time. |
| Your browser's push address, scheduled reminders | Supabase; delivered via your browser's push service (e.g. Apple, Google, Mozilla) | Only if you allow notifications (Art. 6(1)(a) GDPR) | Until you turn them off in the browser or delete everything; sent reminders after 2 days |
| Game statistics: platform (Android app or web), session length, era reached, features used, rescues, sharing, friends joined | Supabase | Only with your consent, to improve the game (Art. 6(1)(a) GDPR). You can switch it off any time under ⚙️ Settings | 13 months |
| Source channel: once, the name of the link you first came from (e.g. “whatsapp-status”, “reddit”, “invite”). If you come without such a link, only the rough kind of site you came from (e.g. “suche-google” for a Google search, “ki-chatgpt”, “reddit”, “web-andere”), never its address. In the Android app without another source link, the channel is “android-app”. No tracking, nothing on your device, only this one name on your anonymous account | Supabase | Counting which channels bring players, so we know where it is worth presenting the game (Art. 6(1)(f) GDPR, legitimate interest) | Like your account and cloud save |
| Anonymous usage numbers: how many islands of a start week are played again on day 1, 3 and 7, roughly how long visits last (in steps like 1–5 minutes), how far islands have come overall, how often new visitors press “Play” on the start page, and how often the hints (install the app, notifications, feedback) are accepted or postponed. For this we store only the day of your last game on your account, otherwise only sums without an account. Nothing is stored on your device for this | Supabase | Improving the game (Art. 6(1)(f) GDPR, legitimate interest). You can object any time by e-mail to the address in section 1. | Sums 13 months; the last day played until the account is deleted under the periods above |
| Feedback you send from inside the game (text, mood, era reached, phone or computer) | Supabase | Improving the game, because you send it to us (Art. 6(1)(a) GDPR) | Until you choose “Delete all my data”, at most 13 months |
| Error and stability reports (platform Android app or web, error message, code location, page, phone or computer, operating system and browser with main version only, installed app or browser, game version; for crashes and hangs also the affected view or loading step). No account and no IP address | Supabase | Only with your statistics consent: finding and fixing bugs (Art. 6(1)(a) GDPR) | 90 days |
| Anonymous operational monitoring: only the latest cloud-save timestamp per hour, without an account ID or IP address | Supabase; readable only by our team | Detecting and fixing cloud-save outages (Art. 6(1)(f) GDPR) | Current day and the seven preceding days |
| Island name reports: random account ID of the reporter, island account ID, reported name and time | Supabase; readable only by our team | Reviewing inappropriate island names and protecting friend features | Until either account is deleted |
3. Hosting
The website is delivered by Vercel Inc. (USA). When you open it, Vercel processes technically necessary connection data such as your IP address to deliver the page (Art. 6(1)(f) GDPR). Vercel is certified under the EU-US Data Privacy Framework. The database and server functions run at Supabase Inc. in the Frankfurt am Main data centre (AWS eu-central-1), i.e. inside the EU. Supabase technically processes the IP address in short-lived server logs; we do not store it.
Visitor counts and load times (Vercel Web Analytics, Speed Insights): We count page views and measure how fast the page loads. No cookies are set and nothing is stored on your device. Visitors are only told apart by an anonymous daily hash that is discarded after 24 hours; there is no tracking across other websites. Recorded are the page, referring page, country, browser and device type, and load times. The legal basis is our legitimate interest in a working, fast website (Art. 6(1)(f) GDPR).
Fonts and images are loaded from our own server, not from Google or other third parties.
4. Your rights
You have the right to access, rectification, erasure, restriction, data portability and objection, and you can withdraw any consent at any time. The fastest way is inside the game via the gear (⚙️ Settings) at the top of your island: switch off statistics or, at the very bottom, choose “Delete all my data”. This deletes your account and all related data on the server, as well as the save on this device. If you no longer have the game or the app, you can request deletion by e-mail: How to delete your account. You can also complain to a data protection supervisory authority.
5. Children and teens
Wrecklanders is not directed at children under 13 years of age.
6. Processors
Supabase and Vercel process data on our behalf, based on their standard data processing agreements under Art. 28 GDPR. Google (ads in the app, Google Play) is not a processor but responsible for its own processing (see section 8).
7. Changes
If new features are added (for example ads in the web version or purchases), we will update this policy beforehand and ask for your consent where required.
8. App version (Android)
Applies from version 1.0 of the Android app
The Android app is the same game with the same pseudonymous account (random ID, without name, e-mail or password). Everything in sections 1 to 7 applies there too. The game files are part of the app and are not loaded from Vercel. In addition, the app works like this:
8.1 Optional ad videos (Google AdMob)
The app can show short ad videos, but only when you tap a video button yourself. Before every video it says what you get for it (for example a longer tailwind). Without a video you keep playing normally. There are no banners, no ads in between and no ads that start by themselves; at most 10 videos a day. The videos are delivered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, via the Google Mobile Ads SDK (AdMob).
| Data | Where | Purpose / legal basis | How long |
|---|---|---|---|
| IP address, your Android device's advertising ID and app set ID, device and app details (e.g. model, Android version, language, app version), what happens with the video (loaded, watched, tapped), diagnostics | Google (Ireland; transfer to Google LLC in the USA possible, which is certified under the EU-US Data Privacy Framework) | Delivering the video, confirming the reward, measuring ads, preventing fraud. Access to your device and personalised ads only with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). Google is an independent controller for this (Google Ads Controller-Controller Data Protection Terms) | According to Google's rules: Privacy Policy, How Google uses information from partners' apps |
| Your consent choice (TCF string) | Stored on your device, in the app's storage; sent to Google with every ad request | Remembering your choice and telling Google what is allowed (Art. 6(1)(c) with Art. 7(1) GDPR) | Until you change it or uninstall the app |
| How many videos you watched today (counter for the daily limits) | In your save: on your device and as a backup at Supabase | So the daily limits apply (Art. 6(1)(b) GDPR) | Like your save |
Consent: On the first tap on a video offer, the app uses Google’s User Messaging Platform (UMP, based on the IAB TCF standard) to check whether consent is required and shows Google’s consent dialog when needed. Only then can a video be loaded. If you agree, Google may tailor the ads to you. If you decline, non-personalised or limited ads may be available depending on Google’s permission to request ads. The game keeps working; videos may be limited depending on availability. The maximum ad content rating remains “General” (G).
Withdrawing consent: You can change your choice at any time in the app under ⚙️ Settings → Ads → “Privacy options”. You can also reset or delete the advertising ID in your Android settings (usually under “Privacy” or “Google → Ads”, depending on the device).
What we get from Google: only summary reports (e.g. how many videos were shown in total and what they earned), nothing about individual players. We also count offers (button visible for at least one second), starts, completions, cancellations, errors and unavailable videos for each video moment as anonymous daily totals, split by app/web and app version. These counters contain no account, user, device or advertising ID, no IP address and no game progress or age. Only “+1” with fixed categories is sent; nothing is stored on your device for these totals. Like our start-page counters, they do not require statistics consent; retention: 13 months. Statistics consent and Google’s advertising consent remain separate.
8.2 Notifications
The app reminds you with local notifications (e.g. “Expedition is back”). The app schedules them directly on your device. There is no push server and no push address for this; the push details in section 2 only concern the web version. From Android 13 the device asks for your permission first (Art. 6(1)(a) GDPR). You can turn them off any time in the app's Android settings.
8.3 Google Play
You get the app via Google Play. Google itself is responsible for downloads, updates and reviews (Google Privacy Policy). In the Play Console we only see summary numbers (e.g. installs) and, if you allowed sharing diagnostics in Android, crash reports without name or account.
8.4 Deleting your account
In the app: ⚙️ Settings → “Delete all my data”. Without the app: request deletion by e-mail. Data that Google processes for ads is managed at Google (reset the advertising ID, My Ad Center).