Privacy notice

What we keep, and why

Last changed 2026-10-05.

The short version

The game does not ask for your name or email. Contacting us or supporting development through Ko-fi can share contact information, as explained below. You play as a guest: a random identity with a made-up name like "Quiet Loon". An account is optional; it adds a private username and your age category. You can use a password we keep only scrambled, or a configured sign-in provider such as Google or Discord.
We keep your online matches so you can look back at them, until you delete them.
The game has no ads, cross-site tracking, chat or location collection. We count service events to see where loading, learning, and matches fail. The optional Discord community is a separate service with its own accounts, messages and privacy policy.
We do not sell your information or share it for advertising. Hosting providers handle information needed to deliver the service.
The computer opponents currently learn only from bot matches. Any future research use of your replays is limited to adults who allow it: guests switch it on themselves. At adult account sign-up the choice starts on in the United States and off everywhere else, and can be changed at any time. It is always off for accounts identified as under 18.

Who runs this site

The operator of this site (country not yet published) decides how this information is used. In data protection law, the operator is the "controller". Contact: not yet published. Postal address: not yet published. Telephone: not yet published.

What we keep

If you play the practice edition on itch.io, itch also provides the player frame. Its hosting script reports the embedding domain and upload ID to itch. That platform data is separate from game accounts and follows itch.io's privacy policy.

What	Where	Why	How long
Your settings: sound, contrast, motion, which lessons you finished	Your browser only	To remember your choices	Until you clear this site's data
Your guest key and made-up name	Your browser; the host keeps only a one-way hash of the key	To recognise you as the same guest when you come back	Until you delete your data
Your seat in a match you are playing, or your place in the queue	Your browser, for this tab only	To put you back after a reload or a dropped connection	Until the tab closes or the match ends
Your online matches: the random match ID, when it was played, both players' made-up names and random IDs, every move and strike, the scores, and how it ended	The host	To show you your matches and replays, offer rematches, and check that every match was resolved fairly	Until you delete your data
Your solo river journey: the route and every move you made in it, and the Fish Coins your river clears earned (about 2 KB)	The host, under your guest key	To let you continue or review the journey from this browser	Replaced with each move; until you delete your data
How often a guest leaves matches early	The host, in memory	To pause the queue for players who keep abandoning matches	An hour at most, and gone when the host restarts
Your network address	The host, in memory	To limit connections and authentication attempts, which protects the game from floods and password guessing	While connected and in temporary connection/authentication throttle state afterwards; the game host does not write addresses to its data files
Your research choice, and when you made it	The host	To know whether you said yes	Until you change it or delete your data
If you make an account: your username (only you and our admins see it), a scrambled form of any password you set (an Argon2id hash, never the password), whether you are under 13, 13 to 17, or an adult, and for a minor the month you turn 18 (never your birth date)	The host	To sign you in, keep your matches with your account, and apply the age rules	Until you delete your data
If you link a sign-in provider: the provider name and its stable identifier for your account	The host; temporary encrypted sign-in proof in your browser	To recognise the linked game account when you choose provider sign-in	The link lasts until you unlink it or delete the account; provider-session proof lasts up to one hour or until you sign out of that provider session
If you set up an authenticator app or recovery codes: the app's secret key, and scrambled forms of your recovery codes	The host	To check your codes	Until you delete your data
If our admins act on an account, or someone tries to use admin powers they do not have: who acted, what they did, to which account, and when	The host	So every use of admin powers can be checked afterwards	Until the operator removes it
If you sign in: a sign-in key in your browser, and a scrambled form of it on the host	Your browser and the host	To keep you signed in	30 days, or until you sign out

Guest inactivity expiry pauses while a guest is connected. Accounts with administrative roles are excluded from automatic guest expiry. Encrypted backups are retained for up to 14 days. Deleting live game data does not immediately remove older encrypted backup copies; they expire through rotation. Backups are not used for play or research. Before restoring one, the operator must invalidate restored sign-ins and reapply later deletion and security changes.

The host also counts totals, for example how many matches finished or how long the queue took. Its game log records match codes, rounds, winners, and errors; it does not include access credentials or raw network addresses.

Vector shared NPC learning

Vector can download a shared NPC learning base while keeping its individual ranking calculations in the game's own engine. Contributing your own learning summaries is optional and off until you enable the checkbox in Vector. A summary contains a game-specific pseudonymous identifier, a rating estimate and learned behavior statistics, rather than your username or a move-by-move replay.

The site temporarily queues submitted summaries on the Oracle backend and runs Vector's own verified learning executable. Accepted or refused summary bodies are discarded after processing; identifiers and receipt hashes remain to prevent duplicate processing. The downloadable base contains population parameters and opaque player identifiers. Contributions already incorporated remain in that base. Turning sharing off stops future uploads and clears this browser's pending summary.

Anonymous service counts

Cloudflare delivers this site. At the edge we count game loads, lesson steps and completion, actual play starts, progress and outcomes, and signup starts and finishes. Static page requests do not invoke the game’s event counter. Events contain a fixed event name, public build, broad screen-size category and test/automation category. Play events also contain the mode, NPC policy when applicable, round or river section, result and end reason, approximate active duration and server receipt time. A fresh random attempt label joins events for that attempt; it is kept only in the tab’s session storage so a reload can resume it. It is not a person or cross-site identifier and does not link to a game account. We store no address, full URL, query string, username, guest key, match code, account ID or visitor ID in these counts. Cloudflare keeps event rows for three months.

These are events and attempts, not unique visitors. An incomplete attempt has no confirmed finish; a paused or disconnected attempt can resume. Each PvP seat reports its own outcome. A return hint uses an existing completed-guide preference. Known QA, detectable automated browsers and verified bots are separated; an unmarked browser is not proof of a human. Counts can miss events, and the offline itch edition sends none. Do Not Track and Global Privacy Control turn these counts off.

Cloudflare may use its own security cookies and connection logs to protect delivery of the site. The game adds no tracking cookies. Anonymous counts do not include replay research or change your research choice.

Why we are allowed to

Running the game you asked for: your guest identity, matches, replays, and rematches. Under the GDPR, this is performing our terms with you (Article 6(1)(b)). Where that does not apply, for example for someone too young to agree to terms, it is our legitimate interest in running the game (Article 6(1)(f)).
Fair play and security: the queue pause for repeated abandons, connection limits, and blocking a guest who abuses the game. These rest on our legitimate interest in a fair, working game (Article 6(1)(f)).
Research preferences: we keep your choice so a future replay export can check it. Computer opponents currently learn only from bot matches. Before research with player replays starts, we will publish its purposes, legal basis, and safeguards. The export gate requires both players' permission at the match's end and afterwards, and excludes accounts identified as minors.

Storage on your device

The game keeps settings, guest keys, current match seats and editor projects in your browser. Your solo river journey is kept by the game's host for your guest key: the route and your recorded moves, so you can continue or review it. It goes when you delete your data or stop playing for the retention period. Account sign-in uses protected cookies and short-lived security cookies; your game password and provider credentials are not stored in the game's browser storage. The game session lasts up to 30 days and is revoked when you sign out. Provider-session proof lasts up to one hour; use Sign out of provider session to clear it sooner. Clearing this site's browser data removes these local copies. If you clear an unlinked guest key, the host can no longer tell that the old guest's matches were yours. Cloudflare may also use security cookies to protect delivery.

Provider sign-in is optional and starts only when you choose it. The game requests basic identity access from Google or Discord and does not request email access or Discord server membership. We use the provider's stable account identifier to link your game account; matching names or email addresses do not combine accounts. Providers handle their own accounts and sign-in activity under their policies: Google and Discord. Signing out of the game does not sign you out of the provider's own site.

Children

The game limits what players can share, including when children play:

There is no player chat or public text entry. Optional accounts ask for a private username; please do not use a real name.
Players see only each other's made-up names.
There are no ads and no location.
Research is off for anyone who has not told us they are an adult.
Accounts ask your birth month and year once. We keep whether you are under 13, 13 to 17, or an adult and, for a minor, the month used for the adult-age transition. We do not ask for the day, so age eligibility waits until that birthday month has ended in UTC. Becoming an adult does not turn research on: you must choose it. Depending on this site's setting, accounts are for players 13 and over, and younger players play as guests.

For guests under 13, the random persistent identity is used for internal operations: recognising a returning guest, keeping the guest's requested matches and settings, network communication, protecting the service, and enforcing fair play. It is not used to contact a child, advertise to them, build a profile for another purpose, or train computer opponents. The retention periods above limit how long game identities and records are kept.

Information from children under 13

We treat every player as a child unless an account says otherwise. From a child under 13 the game keeps only what it needs to run the game the child asked for:

a random guest key (the host keeps a one-way hash of it), and the made-up name the game assigned;
the child's online matches and replays, and their solo river journey;
if an account is made: a private username, a scrambled password or a provider's stable account identifier, and the age group, never the birth date.

We use this only to recognise a returning player, keep the matches, journey and settings the child asked for, carry the connection, protect the service and keep play fair. We do not use it to contact the child, show advertising, build a profile, train computer opponents, or for research, and we do not sell or share it. Cloudflare and Oracle Cloud process it for us only to deliver and run the game. Players cannot post text or contact each other in the game.

A parent or guardian can review what we hold, have it deleted, and refuse further collection: use My matches → Download shown matches and Delete my data on the child's device, or contact us at the address above. We will check control of the guest or account before acting, and deleting stops further collection for that identity. Browser settings can be removed by clearing this site's data. If you think a child switched research on, tell us: we will switch it off and remove their replays from any research set.

How long we keep information, and why

We keep information only as long as the reasons below need it, then delete it. This applies to children's information too; nothing is kept indefinitely.

What	Why we need it	When it is deleted
Guest identity, made-up name and research choice	To recognise a returning player, who may come back after weeks or a school term away	When you delete your data
Online matches and replays	To show your history and replays, offer rematches, and review a disputed or unfair match	When you delete your data
Solo river journey and its Fish Coins	To let you continue or review your journey, and count each course's Fish Coins once	With the guest identity (including when it expires), and replaced by each move
Account username, password scramble, sign-in methods and age group	To sign you in and apply the age rules	With the guest identity, or when you delete the account
Sign-in keys	To keep you signed in	30 days, or when you sign out
Record of administrative actions	To check every use of admin powers and investigate security problems	When the operator removes it
Encrypted backups	To recover the game after a failure	14 days after each backup
Messages you send us	To answer and resolve your request	180 days after the request is resolved, unless an open dispute, security incident or legal duty needs it longer
Anonymous service counts	To find where loading, learning and matches fail	Cloudflare keeps them for three months

Your choices and rights

Download the records shown to you: My matches → Download shown matches saves a fresh list for your current account or guest, up to 50 recent online matches. This file is not a complete copy of all your data. For older retained records or other account information, contact us.
Delete it: My matches → Your data & research preferences → Delete my guest data (or Delete my account & data when signed in). This removes your guest identity from the host, and your name from every match you played. If you are signed in, it also permanently deletes your account, password, authenticator configuration, recovery codes, and all roles, including owner, admin, or moderator access, and ends all sign-ins on every device. Your opponents keep their own record of those matches, with you shown as a deleted guest. This cannot be undone.
Research: switch it on or off at any time under My matches → Your data.
Ask us to do any of these, or to explain what we hold, restrict its use, or stop using it. Game accounts have no email address. We will verify control of your guest identity or account before acting; a guest ID in a download identifies a record but is not proof of ownership. Do not send a password, sign-in token, authenticator secret, or recovery code.
Complain to your data protection authority: in the UK the Information Commissioner's Office, in the EU the authority of your country. We would rather hear from you first.

We do not sell personal information or share it for advertising. Matchmaking automatically pairs players who are waiting.

Who else handles it

Cloudflare delivers the site, game assets, protected editor and sign-in routes, and handles network requests and anonymous service counts. Oracle Cloud runs the existing trusted backend for game accounts, permissions and online play. Configured host and region details: not yet published. Providers may keep their own security and connection logs under their policies. Data may be processed outside your country; contact us for confirmed server-region and transfer-safeguard information.

Contact and optional support

If you contact us, we receive the contact details and message you choose to send and use them to answer and resolve the request. Proton Mail handles the game contact mailbox and its delivery metadata under its privacy policy. Ordinary email from another provider is not automatically end-to-end encrypted. Please do not send game passwords, sign-in tokens, authenticator secrets, or recovery codes. We remove routine correspondence within 180 days after the request is resolved. A record needed for an open dispute, security incident, or legal duty is restricted to that purpose and removed when that need ends; provider backups may expire later. Optional support opens Ko-fi only after you follow a link; there is no embedded payment form or payment tracking script in the game.

Ko-fi and its payment provider may share a supporter name, email address, message, and transaction details with the creator. Those records are separate from game accounts and are used to handle support, refunds or disputes, and accounting requirements. Game-data deletion does not delete Ko-fi or payment-provider records. For requests about support information, contact the creator through Ko-fi or the payment transaction; their own terms govern their copies. See Ko-fi's privacy policy. We do not add supporters to a marketing list without permission.

Feedback and private tickets

The Feedback button works from any page, including gameplay. You can send anonymous feedback without an account; it goes to the game owner's private review inbox and has no tracking or reply thread. If you sign in, feedback creates a private ticket that you can track here, including its status and the owner's reply.

We keep the subject and message you enter, the page path and game mode, public build revision, submission time and review status. An account ticket is linked to your game account. Anonymous submissions have no game-account link. No screenshot, replay, URL query, browser history or device fingerprint is automatically attached. Normal security logging and temporary rate limits still apply.

Unsent drafts stay in this tab's session storage until sent, discarded or the tab closes. Tickets and anonymous feedback stay in the private backend for support and review; account deletion removes that account's tickets through the existing deletion and backup-recovery process. Anonymous feedback cannot later be claimed or attached to a new account. Do not include passwords, payment details or other private information. For data or removal questions, contact icefissures@proton.me.

Optional tracked playtests

You may play without signing up for a playtest. To participate in the tracked five-minute program, sign in to a game account and choose the recruitment source, device type and browser yourself. Submitting the enrollment stores a private account-linked ticket. After playing, you may submit a separate private report describing the mode, approximate duration, first confusing moment, expected result, first Home choice and reason, and any button behavior you expected but did not get. Two submitted session reports are shown as self-reported repeat participation; they do not prove a session occurred.

Only you and the game owner may read your tickets. The owner can see the existing internal account identifier, enrollment source, session reports, review status and private replies when using their protected review interface with recent authenticator verification. The public site cannot see the roster. The fields you enter are not collected automatically by monitoring browser activity, tracking third-party referrals, fingerprinting or recording your game. Game-account deletion removes your enrollment and reports with your other tickets, subject to existing backups and recovery processes. Tickets do not send email reminders because game accounts have no stored email address. You can still submit anonymous feedback instead; those notes are not attached to the tracked roster.

Optional Discord community

Following a community link opens Discord; the game embeds no Discord widget. Joining the community does not link a game account. Choosing Discord sign-in and explicitly linking it in Account is a separate, optional action described above. Joining requires meeting Discord's terms and minimum age for your country. You can play without joining.

Discord handles account, device and connection information and the content you share under its privacy policy. Community members can see messages and profile information in channels available to them. The operator and moderators use member information, reports and content to organize games, answer feedback and enforce the server rules. A publicly shared invitation lets other people join; treat shared channels as public spaces and keep private information out of them.

Deleting game data does not delete Discord messages or your Discord account. Use Discord's message/account controls for its copies, or contact the game operator for community moderation or information requests. Routine reports follow the contact-record period above; information needed for an open dispute, security incident or legal duty is restricted to that purpose. Discord's own retention rules govern its copies. We do not add members to a marketing list.

Security

Online play travels over encrypted connections only. Guest keys are random, and the host stores only their hashes. Identities, matches, and seats use random IDs and access credentials to make guessing impractical. Cloudflare delivers game assets and forwards trusted online requests to the Oracle backend. Most rendering, practice play and editor work stay on your device; the solo river plays on your device and the host keeps only its compact journey. External support links open a separate site only when followed. If you find a security problem, please report it to the contact above.

Changes

If we materially change what we keep or why, we will update this page and its date before the change. We will explain how it affects information already held and obtain permission where required.