ISLES OF CALAMITY

← All legal & policies

Cookie Notice

Effective: 16 July 2026 · Last updated: 16 July 2026

The short version.

  1. We set three cookies of our own, and only for things you asked us to do: remembering your name in the site header after you sign in (ioc_who), carrying out a sign-out (ioc_signout), and stopping the same person voting twice in a poll (ioc_voter). None of them track you across other websites.
  2. We use Google Analytics — but only if you press Accept on our banner, and only on our public pages. It never runs on your account, sign-up, recovery, billing, developer or status pages. Press Decline and nothing is loaded.
  3. We do not show adverts, and we set no advertising cookies. If that ever changes we will ask for your consent first and update this notice before the first advert appears.
  4. Your sign-in token and a few caches are kept in browser storage, not cookies — they are never automatically sent to us or to anyone else. Your analytics choice is stored the same way.
  5. You can change your mind at any time via Cookie preferences in the footer. That stops analytics from loading again — to erase cookies already set, clear cookies in your browser.
  6. We do not sell your personal information, and we do not use any of this to build an advertising profile of you.

1. Who we are, and what this notice covers

This Cookie Notice explains the cookies and similar storage technologies used on the Site — the websites at islesofcalamity.com and its subdomains. It is published by Pixel Glitch Studios of Postal address: to be published (business mailbox pending) — contact support@islesofcalamity.com ("we", "us"), the operator of the Game. "You" means the person using the Site.

Capitalised terms used but not defined here — including Account, Character, the Game and the Site — have the meanings given to them in our Terms of Service, and are used consistently across all of our policies.

1.1 Scope

  1. This notice covers the Site only. The downloadable Game client is a separate program governed by the licence agreement shown when you first run it; it is not a web browser and does not use the cookies described here.
  2. This notice sits alongside our Privacy Policy, which explains the personal data we process, why, and on what legal basis. Where this notice describes personal data, the Privacy Policy governs how we handle it.

2. Cookies and other browser storage — the difference

Two different technologies are described in this notice, and it is worth being precise about which is which, because they behave differently:

  1. Cookies are small values your browser stores and then automatically sends back to the server with every matching request. Cookies are listed in §3.
  2. Browser storage (localStorage and sessionStorage) is held by your browser and is never sent anywhere automatically. It is only read by the Site's own code running in your browser, and only that code can decide to send anything derived from it. Browser storage is listed in §4.

The law that applies to storing and reading information on your device (in the EU/UK, Article 5(3) of the ePrivacy Directive as implemented locally) applies to both, regardless of the label. We treat them the same way, and §9 sets out the basis for each.

3. Cookies we set

These are all of the cookies the Site sets. All three are first-party (set by us, not by a third party), all are limited to SameSite=Lax, all are marked Secure so they are only ever sent over an encrypted connection, and none of them is used for advertising, profiling, or tracking you across other websites.

Name Purpose Lifetime Category
ioc_who Lets the site header greet you by name once you are signed in. It contains only your Account display name — a name that is already public on hiscores and profiles. It carries no token, grants no access, and authorises nothing: every action that reads or changes your Account still requires your sign-in token, which this cookie does not contain. It is scoped to our registrable domain so the header is consistent across our subdomains, and it is set only after you sign in. 30 days, renewed each time you open your Account page Functional (see §9.2)
ioc_signout Carries out a sign-out. Only the Account subdomain can revoke a session, so when you press Log out from any other page this cookie carries that instruction across. It holds the single value 1, and is deleted the moment it is used. It is deliberately a cookie rather than a link parameter, because a browser will only let our own site set it — which means another website cannot force you to be signed out. 120 seconds, or until used — whichever is sooner Strictly necessary
ioc_voter Stops the same browser voting twice in the same poll. It holds a random identifier with no meaning outside our poll counts — it is not derived from you, your Account, or your device, and it is not linked to your Account. It is HttpOnly, so page scripts cannot read it. It is set only at the moment you cast a vote — reading or browsing polls sets nothing. 400 days Strictly necessary

3.1 Analytics cookies — only if you accept

If, and only if, you press Accept on our cookie banner, Google Analytics 4 is loaded on our public pages and Google's script sets its own cookies in your browser:

Name Purpose Lifetime Category
_ga, _ga_7PWW3P94J9 Set by Google Analytics to distinguish one visitor from another and to measure how our public pages are used, so we can improve them. Set only after you consent, and only on the pages described in §5.2. Set by Google's script, not by us — we do not configure it, so Google's default applies: up to 2 years Analytics — consent required (§9.3)
  1. Because Google's script — not ours — sets these cookies, their exact names and lifetimes are determined by Google and can change without a change on our side. By default Google scopes them to our registrable domain. That means that once set, your browser may continue to send them to our other subdomains even though no analytics code runs there and no analytics data is collected there (§5.2). To remove them entirely, clear cookies in your browser (§8.2).
  2. If you never accept, none of these cookies is ever set, and no analytics script is ever loaded.

4. Browser storage we use

None of the items below is a cookie, and none is automatically transmitted to us or to anyone else.

4.1 Persistent storage (localStorage) — kept until you clear it

Name Purpose Category
ioc.session The token that keeps you signed in — the credential itself. It is stored when you sign in on the account subdomain, when registration signs you in automatically on the create subdomain, and, for staff, on the developer subdomain. On the billing subdomain the same name holds a separate, short-lived token handed over from your Account page so that you can manage membership; that one is removed from the address bar immediately so it is not left in your browser history. Browser storage is per-site, so each of these is a separate store that only that subdomain can read. Removed when you sign out. Strictly necessary
ioc.cookieConsent Records your answer to the cookie banner — the single value granted or denied. This is what stops us asking you on every page, and what keeps analytics switched off if you declined. Strictly necessary
ioc_fx_cur Remembers which currency you chose to view prices in on the membership management page. A currency code only. Functional

4.2 Tab storage (sessionStorage) — discarded when you close the tab

Name Purpose Category
ioc_fx Caches published currency-conversion rates so prices can be displayed without re-fetching them on every page. Contains no information about you. Strictly necessary
ioc-online Caches the "adventurers online" figure shown in the header for up to a minute, so that the count does not re-fetch on every page. Contains no information about you. Strictly necessary

5. Analytics, and how consent works

5.1 Nothing loads before you choose

  1. We use Google Analytics 4 (measurement ID G-7PWW3P94J9) to understand how our public pages are used and to improve them.
  2. Until you press Accept, no analytics script is requested, no analytics cookie is set, and no analytics data is collected or sent to Google. Consent is prior, not retrospective.
  3. The banner offers Accept and Decline as two equally available choices. Declining is a real, remembered answer, not a deferral — nothing loads, and we do not ask again unless you ask us to.
  4. We do not treat continued browsing, scrolling, or closing the banner as consent. Only pressing Accept is consent.
  5. Declining costs you nothing: every part of the Site works identically either way.
  6. We show the banner to every visitor to our public pages, not only to those in regions whose law requires it.

5.2 Where analytics runs — and where it never runs

  1. Analytics is loaded on our public marketing pages only — the main site, including news articles, player profiles, item pages and hiscores.
  2. Analytics is never loaded on the account, create, recover, billing, dev or status subdomains. This is enforced in code by an exact list of permitted hostnames: on any other hostname the analytics and consent code is never even requested. Consequently no analytics data is collected while you sign in, register, recover an Account, or manage payment.
  3. Our sign-in token is never disclosed to Google, and we do not send your Account identifier, email address or display name to Google Analytics.

6. Advertising

  1. We do not serve advertising on the Site. There is no advertising code on any page, we set no advertising cookies, we have no advertising partner, and we do not use any of the storage described in this notice to build an advertising or marketing profile of you.
  2. An earlier version of this notice described Google AdSense advertising and offered opt-out links for it. That description did not reflect what the Site does: no advertising has been served and no advertising cookie has been set. It has been corrected here.
  3. Our security headers currently permit connections to certain Google advertising domains. That permission is preparatory and unused: no code on the Site requests those domains, and permitting a domain neither contacts it nor sets any cookie. If we do introduce advertising, paragraph 4 applies in full.
  4. If we introduce advertising in future, we will: (a) update this notice, naming the provider and its cookies, before the first advert appears; (b) ask for your consent through the banner first, in the same way as analytics, so that no advertising cookie is set on a "decline" or on no answer; and (c) publish a "Do Not Sell or Share My Personal Information" mechanism before, not after, advertising begins. Until all three are in place, no advertising will run.
  5. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

7. Third-party content

7.1 Video embeds

  1. Some news articles contain an embedded YouTube or Twitch video. Only articles that actually contain one load anything from those services; the rest of the Site does not.
  2. Where we embed YouTube, we use YouTube's privacy-enhanced mode (youtube-nocookie.com), which is designed to avoid setting viewing cookies unless you play the video.
  3. When an embed loads or you play a video, the provider may set its own storage in its own context, under its own policies, which we neither control nor read. If you would rather it did not, do not open an article containing an embed, or block third-party cookies for that provider.

7.2 Anti-bot challenge

  1. We have built support for Cloudflare Turnstile, a challenge that tells people apart from automated scripts, on our registration and Account-recovery pages. It is currently switched off, and no Cloudflare challenge code is loaded on any page.
  2. When we switch it on, it will appear on registration and Account recovery only. It is a security measure protecting the registration and recovery process you asked to use — it is not analytics or advertising, and it is not used to track you. Any storage it uses would be set by Cloudflare in Cloudflare's own context, under Cloudflare's policies, and we would not read it. We will update this notice when we enable it. No analytics runs on those pages in any event (§5.2).

8. Changing your mind

8.1 Withdrawing or granting consent

  1. Select Cookie preferences in the footer of any public page. The banner reopens, and you can press Decline or Accept. It is exactly as easy to withdraw consent as it was to give it, and you may do so at any time.
  2. Withdrawing consent has no effect on the lawfulness of processing carried out while your consent was in place.

8.2 What withdrawal does, precisely

  1. Pressing Decline records your refusal and stops Google Analytics being loaded from that point on.
  2. It does not by itself delete _ga cookies already set in your browser from an earlier acceptance, and analytics already running in the page you are looking at continues until you navigate away or reload. To remove those cookies, clear cookies for this site in your browser — that takes effect immediately, and we would rather tell you that than let you assume otherwise.
  3. Because your choice is stored in your browser (§4.1) rather than against your Account, it applies to that browser. Clearing your site data also clears the record of your choice, so we will ask again — and until you answer, analytics stays off.

8.3 Blocking storage yourself

  1. Every major browser lets you block or delete cookies and site data, and offers a private-browsing mode that discards them when you close it. Our banner and site are built to fail safely if storage is unavailable.
  2. Blocking the storage in §3 and §4.1 is your right, but it will have practical effects: you cannot stay signed in without ioc.session; without ioc_voter a poll cannot tell that you have already voted; and we will ask about analytics on every visit if we cannot remember your answer.

9. The legal basis for each item

9.1 Strictly necessary — no consent required

  1. Under Article 5(3) of the ePrivacy Directive (and equivalent UK rules), storage is exempt from consent where it is strictly necessary to provide a service you have explicitly requested.
  2. We rely on that exemption for ioc_signout (you pressed Log out), ioc_voter (you cast a vote, and a poll that cannot count once per person is not a poll), ioc.session (you asked to sign in), ioc.cookieConsent (it exists only to honour your own privacy choice, and it would be perverse to require consent to remember a refusal), and the two caches in §4.2 (they are technical, short-lived, and contain nothing about you).
  3. Each is set as a direct result of something you did. None is set on a passive visit.

9.2 Functional — our position, stated openly

  1. ioc_who and ioc_fx_cur are functional: they exist to reflect a choice you already made — to sign in, or to view prices in a given currency — and neither is used for analytics, advertising, or tracking.
  2. We do not ask for separate consent for these two. Our reasoning is that each is set only after, and only because of, an action you took, that ioc_who merely reflects your own signed-in state back to you for as long as you asked to stay signed in, and that neither reveals anything about you that you have not already made public or chosen yourself.
  3. We state that reasoning rather than assert a conclusion, because the boundary between "strictly necessary" and "functional" is a matter of judgement, and a supervisory authority could take a stricter view of a 30-day cookie than we have. If you disagree with our reading, you can block or delete these cookies at any time (§8.3), and you can complain (§11.3). Neither costs you access to anything.

9.3 Consent — analytics

  1. Google Analytics and its cookies are not necessary for anything you asked us to do. They are loaded only on your consent under Article 5(3) ePrivacy, and the resulting personal data is processed on the legal basis of your consent under Article 6(1)(a) GDPR.
  2. If we introduce advertising, it will fall in this category too, and will be consent-gated before it runs (§6.4).

10. Where this data goes

  1. We operate from the United States and our infrastructure runs in the us-east-1 region of Amazon Web Services in the United States. If you are in the EEA, the UK or Switzerland, data described in this notice is therefore transferred to the United States.
  2. If you consent to analytics, the data Google Analytics collects is processed by Google, including in the United States, under Google's own terms.
  3. The safeguard we rely on for those transfers is: Your data is processed in the United States. Where EU or UK law requires a transfer safeguard, we currently rely on the safeguards our providers publish for their own services (such as EU–US Data Privacy Framework certifications and standard contractual clauses) while we formalise our own documentation; this is under review.
  4. If Article 27 requires appointments, the EU and UK representatives will be identified as We have not yet appointed an EU representative under Article 27 GDPR; until we do, players in the EU should contact us directly at support@islesofcalamity.com and We have not yet appointed a UK representative under Article 27 UK GDPR; until we do, players in the UK should contact us directly at support@islesofcalamity.com.
  5. Our Privacy Policy sets out how we handle personal data generally, including transfers, retention and the full list of recipients.

11. Your rights

  1. Where the storage described here involves your personal data, you have the rights set out in our Privacy Policy — including, depending on where you live, the rights to access, correct, delete, export, restrict or object to that data. You can download the data held about your Account, and request its deletion, from your Account page.
  2. You may withdraw consent to analytics at any time under §8, without giving a reason and at no cost.
  3. You have the right to lodge a complaint with a data protection supervisory authority. If you are in the EEA, that is the authority in the country where you live, work, or where you believe the issue arose; if you are in the UK, it is the Information Commissioner's Office. You may complain to them directly — you do not have to contact us first, though we would like the chance to put things right.
  4. We prefer to resolve things without a complaint. Write to support@islesofcalamity.com and a person will read it.

12. Your statutory rights are not affected

  1. Nothing in this notice removes, limits, or overrides any right you have under mandatory law that cannot be excluded by agreement.
  2. If you are a consumer in the European Economic Area or the United Kingdom, you keep every right your local consumer and data protection law gives you, regardless of anything stated in this notice, in our Terms of Service, or in any limitation or exclusion clause in them. Those rights sit above this notice, not below it.
  3. We are based in the State of California, and California and United States federal law govern our relationship with you. Where you are a consumer habitually resident in the EEA or the United Kingdom, that does not deprive you of the protection of the mandatory provisions of the law of the country where you live.

13. Changes to this notice

  1. If we change the cookies or storage we use, we will update this notice and the "last updated" date above it.
  2. If we add anything that requires consent — advertising in particular — we will ask for that consent separately and in advance. An answer you gave to a previous banner is not consent to a new purpose, and we will not treat it as such.

14. Contact

  1. Questions about this notice, or about cookies and storage on the Site, go to support@islesofcalamity.com.
  2. By post: Pixel Glitch Studios, Postal address: to be published (business mailbox pending) — contact support@islesofcalamity.com.