For explorers the short version
- We keep your name (the one your grown-up typed in) so the map knows whose boat is whose.
- We keep your game: your islands, stars, chests, boat and crew, so they’re there next time, on any device.
- That’s it. No email, no birthday, no photos, no messages. Nobody else can see your game. There are no adverts.
- Your grown-up is in charge. They can change your name, start your game again, or delete it all, from the grown-ups’ corner.
- Got a question? Ask your grown-up to get in touch with us.
Who we are
The Science Isles is made by Tom Russell, trading as Mathtopus, in the United Kingdom. We are the data controller for what this page describes. To ask us anything about your data, use the Mathtopus contact page or reply to any email we have sent you.
What we keep, and why
As little as a game with saved progress can. Children never give us anything themselves: a parent or carer creates the account and types in each child’s name.
| What | Why | Kept for |
|---|---|---|
| Your email address | To sign you in (we email you a code; there are no passwords) and, if ever needed, to tell you something about your account. We only send news about new islands if you tick that box, and you can untick it at any time. | Until you delete the family account, or it goes unused: if nobody in the family signs in for 18 months we email you a warning, and after 24 months we delete the family and everything in it |
| Each child’s first name or nickname | So the map can show whose boat is whose. We ask for nothing else about a child: no email, date of birth, school, photo or location. | Until you remove the child or delete the account |
| Each child’s game progress | Islands finished, stars, chests, the boat and crew, the bag of mistakes: so the game is there next time, on any device you have signed in on. | Until you reset or remove the child, or delete the account |
| A sign-in code | The six-digit code we email you, stored scrambled so we can check it. | Ten minutes |
| Sign-in counters | How many codes an address or connection has asked for in the last hour, stored as a scrambled fingerprint, so nobody can flood someone’s inbox. | One hour |
| Event counts | How many times a day the map was opened, an island was started or an island was finished. Just numbers: nothing about who, no cookies, no identifiers. | Up to 400 days |
Our hosting provider keeps standard server logs (the page asked for, the browser used and its internet address) for a day or so, as every web service does, to keep the site running and secure. Our email provider keeps a copy of each email it sends for 30 days. We do not use either to track anyone.
What we don’t do
- No adverts, no selling or sharing of data, no third-party trackers or analytics scripts, anywhere in the game.
- No profiling of children and no automated decisions about them.
- No chat, messaging, friends lists, leaderboards or public pages. Nothing about a child is visible to anyone else.
- No location, no camera or microphone, no contacts.
- No cookies apart from one: the cookie that keeps a parent signed in on a device (it lasts 180 days, or until you sign out).
Playing without an account
You don’t need an account. Choose Just explore on the map and progress is kept only on that device, in the browser’s own storage. Nothing is sent to us. Each island’s grown-ups’ corner can make a save code you can paste into another device yourself.
Our legal basis
We keep the email address, the children’s names and their progress because that is what the account is for: it is necessary to provide the service you asked for (“performance of a contract”). The sign-in counters, event counts and server logs rest on our legitimate interest in running a safe, working service, which we have weighed against your family’s interests and found to be minimal in its effect on them. News emails are sent only with your consent, which you can withdraw at any time.
Under UK law a child under 13 cannot sign up to an online service themselves, so the account is always a parent’s or carer’s. By creating one you confirm you are the parent or carer of the children you add.
Where your data goes
We use three providers, each of which processes data only on our instructions: Vercel (hosting), Upstash (the database that holds accounts and progress) and Resend (sends the sign-in emails). Upstash and Resend are in the United States and Vercel runs our code there too; each transfer is covered by the UK’s rules for sending data abroad (the UK extension to the Data Privacy Framework, with the standard contractual clauses and UK addendum behind it). Nobody else receives your data unless the law requires it.
Your rights, and how to use them
Everything below is in the grown-ups’ corner, in one tap, with no need to ask us:
- See it: download everything we hold about your family as a small file.
- Change it: rename a child; untick the news emails.
- Delete it: remove a child and all their progress, or delete the whole family. Both happen straight away and cannot be undone.
You can also contact us to use any right under the UK GDPR, including the right to object or to restrict processing. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, though we would be glad of the chance to put things right first.
Changes
If we change what we keep or why, we will update this page, change the date at the top, and tell signed-in parents by email before the change applies.