Privacy Policy

Last updated: 8 September 2026

Archipelago is operated by MP Labs Ltd. We are responsible for the personal information used to provide this game. Contact privacy@archipelago.game about your information or privacy rights.

Information we use

When you sign in with Google or Apple, our authentication provider, Supabase, receives your account identifier and the basic identity information you authorise, such as email address, name and profile picture. We use this to authenticate you and connect your account to your player profile and saved seats. We do not receive your Google or Apple password. Google sign-in does not request access to your Gmail messages, contacts, calendars or Drive files.

We store the player name, public player ID, optional country and colour preferences you provide; game seats, actions, results, ratings and replay records; and chat, game-night listings, custom artwork and Workshop content you submit. Hosting and authentication services also process technical information such as IP addresses, request times, browser information and security logs. If you contact us, we receive your message and contact details.

Why we use it

We use account and gameplay information to provide the service you request, including sign-in, multiplayer games, saved-seat recovery and community features. Our lawful basis is performance of our agreement with you. We use operational logs and relevant game records for our legitimate interests in protecting accounts, preventing abuse, resolving disputes and maintaining a reliable, fair game. We also process information when required to comply with legal obligations.

What other people can see

Your chosen player name, public ID, country and ranking information can appear in public profiles and leaderboards. Other players see the information shared at their table. Hosts can share spectator links, and completed games may be reviewed as replays. Published Workshop designs and game-night listings are public. Avoid putting private information in player names, chat or shared content. Your authentication email is not a public profile field.

Service providers and international processing

We use Render for application hosting, Supabase for authentication and database services, Cloudflare for domain services, and Google Workspace for support email. Google and Apple process sign-in information under their own privacy notices. Providers process information needed to deliver and secure their services. Our application and database are configured in Frankfurt, but provider support and processing may occur in other countries. Where required, transfers use applicable safeguards such as approved contractual clauses. Contact us for information about the safeguards relevant to your data.

Cookies and device storage

Authentication cookies maintain your signed-in session. Browser storage remembers table access, game preferences and locally saved designs. These features let you reconnect and keep your settings. Clearing site data can remove access to seats that have not been linked to your account. We do not use advertising or analytics trackers in the game.

How long information is kept

Retention depends on whether information is needed to maintain your account, resume games, preserve shared replays and results, handle support or security incidents, or meet legal obligations. Shared game records may remain relevant after an individual stops playing. We review deletion requests against these purposes and explain any information that must be retained; we do not promise immediate removal from provider backups or from copies already saved by other players.

Your choices and rights

You can edit your player profile and revoke Google or Apple access through the provider. Revoking sign-in access does not itself delete your Archipelago records. To request access, correction, deletion, restriction, portability or to object to relevant processing, email privacy@archipelago.game. We may need to verify your identity. Rights depend on the circumstances and applicable law. You can complain to the UK Information Commissioner or your local data-protection authority.

Changes

We will update this notice when our practices change and provide additional notice where required.