Two Islands Privacy Policy

RELEASE-CANDIDATE DRAFT, version 2026-10-19-rc2. The text was reviewed by AI, not by a lawyer. It is waiting for the service owners' sign-off. Do not publish it before then.

1. Who we are

Two Islands is a game for two adults. The data controller is Maksim Paleyeu, trading as Relax Games, a self-employed sole trader (autónomo) in Valencia, Spain. The NIF and the address are in section 12. We process data under the GDPR and the Spanish data protection law (LOPDGDD, Ley Orgánica 3/2018).

Questions and requests about data go to privacy@relaxgames.studio.

2. In short

• Your partner never sees your marks or questionnaire answers as such. Before sunset, your partner sees nothing that depends on them. After sunset, your partner sees only categories on the day's card, with no author.
• Only you see your questionnaire answers. The server computes the "pair climate" from them and does not send it to any device.
• We do not sell data, do not share it for advertising and do not show ads. We do not collect location, contacts, advertising identifiers or birth dates.
• The app sends usage statistics only if you switch them on yourself: with the checkbox on the "Before we start" screen or the switch in the profile. They are off by default. They hold no names, mark contents, answers or advertising identifiers, and they are not linked to your account or your pair. You can switch them off at any time.
• You can download or delete your data in the profile. After a deletion request, you have 7 days to change your mind.
• Daily marks and answers to the question of the day are kept for 30 days, then deleted.
• Data is stored in the EU (Ireland). No data is stored in Russia.
• Backups are kept for up to 30 days.

3. What data we process

Playing with a bot. A separate link with an invitation code lets you play with a bot instead of a partner. That game runs entirely in the browser. Only the code check reaches the server; the server never receives what you mark in this mode.

4. Legal bases

• Explicit consent. Daily marks, questionnaire answers and answers to the question of the day are data about your relationship, that is, about your private life. We treat them as special category data (GDPR art. 9) and process them only with your explicit consent. You give it with a separate checkbox on the "Before we start" screen, before you enter any of this data. You withdraw consent by deleting the account, because the game cannot work without this data. Withdrawal does not affect the lawfulness of processing before it. After a deletion request you can stop marking; the data is deleted 7 days later.
• Consent to statistics. We process usage statistics and their identifier on your device only with your consent (GDPR art. 6(1)(a); for storing the identifier on the device, the consent rule for storing data on a device in the ePrivacy Directive, in Spain art. 22.2 LSSI-CE). The "Send usage statistics" checkbox on the "Before we start" screen is unticked by default, and you can continue without it. You can withdraw consent at any time with the switch in the profile ("Data and documents"): from then on nothing is sent, the statistics identifier is deleted from the device and any events not yet sent are erased. Withdrawal does not affect the lawfulness of sending before it.
• Contract. The account, Apple or Google sign-in, profile, shared world, island care, settings, devices and notifications are needed to provide the service under the terms of use.
• Legitimate interest. Security, abuse prevention and the acquisition source. You can object to this processing by writing to us.
• Legal obligation. Answering requests from authorities that bind us, and preserving data where the law requires it (section 9).
• Users in Russia. The data of all users, including users in Russia, is stored and processed in the EU (Ireland). This is a cross-border transfer. By giving consent on the "Before we start" screen, you also agree to it.

We make no automated decisions that have legal or similarly significant effects on you. The "pair climate" affects only the weather in the game.

5. Who else receives data

We do not sell data and do not share it with ad networks. Data is processed by providers the service cannot run without and, if you switched statistics on, by the statistics service PostHog:

We send no emails at launch, except replies to letters you write to us. If this list changes, we update this table before a new provider receives any data.

Providers that process data on our behalf do so under the standard data processing terms that come with their services. Some of them process data outside the EU, including in the US:

• Supabase (Supabase Inc., USA) hosts the data in Ireland; any access from outside the EU is covered by the EU standard contractual clauses in its data processing terms.
• Cloudflare, Apple and Google take part in the EU-U.S. Data Privacy Framework; their data processing terms also include the EU standard contractual clauses.
• Zoho processes our mail in the EU; any access from outside the EU is covered by the EU standard contractual clauses in its data processing terms.
• PostHog (PostHog Inc., USA) stores the statistics in the EU; any access from outside the EU is covered by the EU standard contractual clauses in its data processing terms.
• Telegram. When you play through Telegram, the data you send through Telegram goes to Telegram under its own rules. This transfer is necessary to provide the service you chose (GDPR art. 49(1)(b)).

You can ask privacy@relaxgames.studio for a copy of these safeguards.

Notification texts contain no names, marks or brick categories.

Helpline directory. The "Someone to talk to" screen has a button that opens Find A Helpline (findahelpline.com), an international directory of free support lines by country. It is an independent site, not one of our providers. We share no data with it: nothing about you, your partner or the island. The button only opens the site in your browser; what the site learns from a visit is described in its own policy.

6. Where and how data is stored

The data of users from every country is stored with Supabase in one project in the EU (Ireland). No data is stored in Russia. The provider encrypts it in transit and at rest. Only the controller and people who keep the service running on his behalf, bound by confidentiality, can access the database. They do not look at the contents of your marks and answers, except at your own request or under a legal order (section 9).

7. Retention

An account nobody signs in to any more (for example, the browser forgot the island and Telegram was not linked) is not deleted automatically today: its profile, questionnaire and shared world stay as long as the pair exists, while its marks and answers are still deleted after 30 days. The partner can leave the pair, and the shared world is then deleted 30 days later.

These deletion times are paused only when data is preserved under a legal order (section 9).

8. Your rights

• Access and portability. In the profile ("Data and documents" → "My data") you can download a JSON file: your profile and settings, questionnaire answers, your marks and answers to the question of the day from the last 30 days, your pet votes, your acquisition source and your consent records. It holds none of your partner's marks or answers. You can ask us for the rest (for example, device records).
• Correction. You can change your name and character in the profile; anything else on request.
• Deletion. Profile → "Data and documents" → "Delete account". More on the account deletion page.
• Withdraw consent to the processing of relationship data by deleting the account. Consent to statistics: with the "Send usage statistics" switch in the profile ("Data and documents"), at any time.
• Object to processing based on legitimate interest: write to us.
• Restrict processing while we look into your request or objection.
• Complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es), which supervises us, or to the data protection authority of your country: where you live or work, or where you think your rights were infringed. You can write to us first, and we will try to resolve it.

Requests that cannot be handled in the app go to privacy@relaxgames.studio. We answer within 10 working days. If a request is complex, we tell you why within that time and answer no more than 5 working days later. Answers are free. So that nobody else gets your data, we may ask you to confirm the request from the app.

Residents of the United States, including California. We do not sell personal information or share it for advertising, including as defined by the CCPA/CPRA. Sensitive information (marks and answers) is used only to run the game. We do not treat anyone worse for using their rights. An authorised agent may make a request on your behalf.

9. Requests from others

• Your partner. Your partner gets only their own data, as in the export from the profile. We do not give your partner your marks, your questionnaire answers or who laid which brick, including after a breakup or divorce.
• Courts, police and other authorities. We consider only written requests that have a legal basis and are binding on us. We disclose the minimum the request requires. Where the law allows, we tell you about it.
• Preserving data. We pause deletion only when the law or a binding order requires it, and only for the accounts it names. If such an account was in a pair, the shared island of that pair is kept too, including the other member's data on it. If you requested deletion and the data must be preserved, from the scheduled date the account looks deleted to everyone, and the data itself is deleted as soon as the basis lapses. Where the law allows, we tell you about the preservation after it ends.

10. Age

The game is for people aged 18 and over. Age is confirmed with a checkbox at sign-up; we do not ask for a birth date. If you choose "I am under 18" on the "Before we start" screen, the account that was just created is deleted at once. If we learn that an account belongs to someone under 18, we delete it.

11. Changes to this policy

We announce significant changes in the app and on this page at least 30 days before they take effect. Changes required by law may take effect sooner. If a change concerns relationship data or widens its processing, we ask for consent again. Until you give it, no new marks are recorded, and you can always download your data and delete the account.

12. Contact

Data controller and service provider (Spanish law LSSI-CE, Ley 34/2002, art. 10):

• Maksim Paleyeu, self-employed sole trader (autónomo), Spain; trading as Relax Games
• NIF: Z2207759V
• Address (domicilio): Calle Sant Ignasi de Loiola 27, piso 4, apartamento 10, 46008 Valencia (Valencia), Spain
• Email: privacy@relaxgames.studio (data questions), hello@relaxgames.studio (general questions)
• Website: relaxgames.studio