Third-Party & Open-Source Notices

1. Scope and defined terms

1. This notice identifies (a) the third-party services we use to operate the Site and the Game, and (b) the open-source software we distribute or run. It is an attribution and transparency notice. It does not describe what personal data we collect or why — the Privacy Policy does that, and the Cookie Notice covers cookies and local storage.
2. Capitalised terms used here — including Account, Character, Membership, Membership Credits, the Game and the Site — carry the meanings given in the Terms of Service. “We”, “us” and “our” mean Pixel Glitch Studios. “You” means the player.
3. This notice covers the Site and the platform services behind it. The downloadable Game client is built with the Unity engine and contains further third-party components; those components are not itemised in this notice.
4. Naming a company below does not mean it is our agent, partner, or sponsor, and does not mean it endorses the Game.

2. Third-party services we use

2.1 Hosting and infrastructure — always involved

1. Amazon Web Services (AWS) hosts the Site and the Game. We use AWS Fargate (compute), Aurora PostgreSQL (database), S3 (storage), CloudFront (content delivery), AWS WAF (request filtering), Amazon SES (outbound email), and Amazon Data Firehose (telemetry delivery).
2. Our AWS region is us-east-1, in the United States. Personal data we hold is stored and processed there.
3. Email we send comes from no-reply@islesofcalamity.com under the display name “Isles of Calamity”. Email you send to support@islesofcalamity.com is received through the same infrastructure.

2.2 Payments

1. Stripe and PayPal are our payment processors for Membership.
2. Membership is not currently offered. While that is the case, no payment is taken and neither processor receives anything from you.
3. When Membership is offered, payment is completed on the processor's own hosted checkout. Card numbers never reach our servers. The processor returns to us only limited billing metadata — payer email, postal code, card last-four digits, card brand, wallet type and country.
4. Each processor handles your payment details under its own terms and privacy policy, as the controller of that data.

2.3 Security

1. Cloudflare provides Turnstile, the challenge that distinguishes people from bots. It runs on registration and account recovery.
2. Have I Been Pwned screens passwords against known breaches every time a password is set. This uses k-anonymity: only the first five characters of a SHA-1 hash of the password leave our servers. Your password never does, and neither does your email address.

2.4 Analytics

1. We use Google Analytics 4 (property G-7PWW3P94J9) to understand how the Site is used.
2. Analytics only loads after you consent, and only on the public marketing site at islesofcalamity.com. It does not load on the account, character-creation, account-recovery, billing, developer, or status subdomains — signed-in areas are not measured.
3. You can change or withdraw your choice at any time through the consent controls on the Site. See the Cookie Notice.

2.5 Services that only engage if you choose them

1. Google, Apple, Discord and Steam provide optional social sign-in. These engage only if you link one of them to your Account. If you never link an account, we send them nothing.
2. YouTube and Twitch provide video embeds. These engage only on a news article that actually contains an embed, and only when you open that article. Most pages on the Site contact neither.

3. Advertising — not in use

1. We do not serve advertising. No advertising network is integrated into the Site and no ad code runs on it. No advertising company receives data about you from us.
2. We may introduce advertising in the future. If we do, we will publish the details on this page and seek your consent before the first ad is served, together with the controls that the law requires — including a way to opt out of any sale or sharing of personal data for advertising purposes.
3. Until that happens, treat any statement that the Game uses an advertising network as incorrect, wherever you may have read it.

4. Open-source components

The following components are the work of their respective authors and are used under the licences named. Each licence is the authors', not ours; we reproduce the attributions they require.

4.1 Components served to your browser

These are delivered to your device as part of the Site.

1. DOMPurify, version 3.4.12 — dual-licensed under the Mozilla Public License 2.0 or the Apache License 2.0, at the recipient's election. We rely on it under the Apache License 2.0. It sanitises the HTML of news articles before they are displayed.
2. TipTap (version 3 series) — MIT Licence. A rich text editor. It is used by our staff to write news posts and is served only on the staff portal.
3. ProseMirror — MIT Licence. The editor toolkit that TipTap is built on, including the prosemirror-model, prosemirror-view and prosemirror-dropcursor modules, distributed within the TipTap bundle.

4.2 Components running on our servers

1. .NET and ASP.NET Core (.NET Foundation and contributors) — MIT Licence. The runtime and web framework of our platform API.
2. Npgsql, version 10.0.3 — PostgreSQL Licence. The PostgreSQL driver for .NET.
3. Konscious.Security.Cryptography.Argon2, version 1.3.1 — MIT Licence. The Argon2 implementation that hashes your password.
4. AWS SDK for .NET — Apache License 2.0. Specifically AWSSDK.SimpleEmailV2 (version 4.0.100.2) and AWSSDK.SimpleNotificationService (version 4.0 series), together with the AWSSDK.Core library they depend on.
5. AWS Lambda libraries for .NET — Apache License 2.0. Specifically Amazon.Lambda.AspNetCoreServer.Hosting (1.7.2), Amazon.Lambda.RuntimeSupport (1.12.0), Amazon.Lambda.Core (2.5.0) and Amazon.Lambda.Serialization.SystemTextJson (2.4.4).

4.3 Components used only to build and deploy

These are not delivered to you and do not run in the Game. They are listed for completeness.

1. AWS Cloud Development Kit — Apache License 2.0: Amazon.CDK.Lib (2.171.0), Constructs (10.4.2), and the aws-cdk command-line tool (2.171.0).
2. xUnit.net (2.9.3) and xunit.runner.visualstudio (3.1.4) — Apache License 2.0.
3. Microsoft.NET.Test.Sdk (17.14.1), Microsoft.AspNetCore.Mvc.Testing (10.0 series) and coverlet.collector (6.0.4) — MIT Licence.
4. Xunit.SkippableFact (1.5.23) — Microsoft Public License (Ms-PL).

The components above are our direct dependencies. They in turn depend on further open-source libraries. We will provide the full dependency and licence inventory on request under section 5.

5. Licence texts

1. This page is our third-party notice. It names each component and the licence it is used under.
2. You may obtain the complete text of any licence named here, and the copyright notices of the component concerned, free of charge by emailing support@islesofcalamity.com or writing to us at the address in section 9. Please name the component.
3. Where a licence entitles you to the source code of a component, that entitlement is against the component's authors on the terms of that licence, and the same request address applies to anything we are required to provide.

6. Trade marks

1. Product and company names used on this page are the trade marks of their respective owners. We name them only to identify the service or software concerned.
2. Their use does not imply any affiliation with, sponsorship by, or endorsement from those owners.

7. Warranties of third-party components

1. Open-source components are provided by their authors “as is”, without warranty of any kind. Their authors and copyright holders accept no liability arising from the software, to the extent their licences say so.
2. Those disclaimers are the authors' own terms. They are the authors' position, not a promise by us and not a promise on their behalf.
3. Our own responsibility to you is governed by the Terms of Service and is not enlarged or reduced by this section.

8. Your statutory rights

1. If you are a consumer in the European Union or the United Kingdom, you keep every right the law of your country of residence gives you. Nothing in this notice — including section 7 and the choice of law in section 9 — removes, limits, or overrides those rights.
2. Some jurisdictions do not permit the exclusion of certain warranties or liabilities. Where that is so, the excluding words in this notice do not apply to you and the rest continues to apply.

9. Governing law and contact

1. This notice is governed by the laws of the State of California and the federal law of the United States, without regard to conflict-of-laws principles, and subject always to section 8.
2. Questions about this notice, and requests for licence texts, go to support@islesofcalamity.com.
3. We do not currently publish a postal address; a business mailing address will appear here once the studio establishes one. Until then, contact us at support@islesofcalamity.com.

10. Changes to this notice

1. We update this page when the services or components we use change. The date at the top shows when it last changed.
2. This page describes what is in use at the date shown. It is not a commitment to keep using any particular service or component.
3. The exception is advertising: as stated in section 3, this page will be updated and consent obtained before any advertising is introduced.