Privacy Policy
What we collect when you use iotcr.com, your account, and the game, why we collect it, and what you can ask us to do with it.
Last updated October 31, 2026
Isles of the Cloud Realm is made and run by Brandon Romano (“we”, “us”). This policy covers iotcr.com, your account at skybridge.iotcr.com, and the game itself. We collect only what we need to run the game. We never sell your data, and we don't show ads.
When you create an account, we store your email address, whether you've confirmed it, and your password. The password is stored as a bcrypt hash, never as the password itself. We use your email to sign you in and to send you codes and notices about your account.
If you choose “Continue with Google”, we ask Google only for your Google account's ID and email address, and whether Google has verified that email. We don't get your name, photo, contacts, or anything from Gmail, Drive, or other Google services.
- How we use it: only to sign you in to your account. If you create an account with Google, its email address becomes your account's email.
- How we store it: the Google account ID and email are saved with your account in our database.
- Who we share it with: no one, beyond the hosting providers listed below. We don't sell it or use it for ads.
Our use of information received from Google follows the Google API Services User Data Policy, including its Limited Use requirements. You can remove our access from your Google Account's connections, and ask us to delete what we've stored.
Each time you sign in, we create a session: which account it belongs to, when it was last used, and in the game, which realm and character you picked. A game session ends an hour after its last use, and a session on skybridge.iotcr.com ends 30 days after its last use.
When you sign in with a password from a browser we don't recognize, we email you a code, then remember that browser so you won't need a code next time. A browser that goes 90 days without signing in needs a new code. Codes we email you last 15 minutes, and password reset links last an hour. We store the codes, links, and cookies that prove who you are only as hashes.
If you join the waitlist, we store your email address and when we emailed you a confirmation or an invite. We use it only to email you about early access.
The game stores your characters and their progress. Chat messages are sent to other players and aren't saved.
If an account breaks the Terms of Service, we may ban it. We keep each ban and its reason, which we show you when you try to sign in. We also keep a log of the changes our admins make, which can include your email address.
We use your IP address to limit how often anyone can try passwords, codes, and sign-ups. Those counts stay in memory for an hour at most and are never saved to our database or logs.
When you create an account or join the waitlist, Cloudflare Turnstile checks that you're a person, not a bot. Cloudflare receives your IP address and some details about your browser to do that, as its Turnstile Privacy Addendum describes. The companies that host our servers also see your IP address when you connect.
iotcr.com counts page views with Vercel Web Analytics. It records the page, the site that sent you, your country, and your browser and device type. It uses no cookies, doesn't follow you to other sites, and tells visits apart with a hash it throws away after 24 hours.
We email you about your account and early access: codes, waitlist confirmations and invites, and notices when something about your account changes, like a new password or a ban. We send other emails, like news about the game, only if you've explicitly agreed to get them, and you can stop them at any time. If you email us, we keep the conversation so we can refer back to it.
iotcr.com doesn't set any cookies. skybridge.iotcr.com sets only the cookies below, and all of them are needed for signing in to work. None are used for tracking or ads.
| Cookie | What it's for | How long it lasts |
|---|---|---|
__Host-iotcr_session | Keeps you signed in to skybridge.iotcr.com. | 30 days after you last use it |
__Host-iotcr_csrf | Stops other sites from submitting forms as you. | Until you close your browser |
__Host-iotcr_verify | Remembers which emailed code this browser is waiting for. | 24 hours |
__Host-iotcr_browser | Remembers that this browser has signed in before, so you don't need an emailed code every time. | 400 days, but a code is needed again after 90 days unused |
__Host-iotcr_authorize | Holds a sign-in that the game started while you finish it in the browser. | 1 hour |
__Host-iotcr_google | Protects a Google sign-in on its way to Google and back. | 15 minutes |
__Host-iotcr_google_signup | Holds your Google sign-in while you finish creating an account. | 1 hour |
Only the people who run the game can see account data, through our admin tools, and only to run the game, answer your requests, or deal with cheating and abuse. We share data only with the companies that help us run the game, and only what each one needs:
- Amazon Web Services runs our account service, the game servers, and our database in Oregon, USA, and sends our emails.
- Cloudflare runs Turnstile when you create an account or join the waitlist.
- Vercel hosts iotcr.com and our admin tools, and runs Vercel Web Analytics.
- Google signs you in, if you choose to sign in with Google.
We'll also disclose data when the law requires it, such as for a valid subpoena or court order, or to protect someone's safety. If the game changes hands, to a company or a buyer, we'll email you before anyone else's policy applies to your data.
- Your account, characters, and Google sign-in: until you delete your account.
- Sessions, codes, reset links, and remembered browsers: they stop working when they expire, as described above. The records stay with your account and are deleted with it.
- Waitlist entries: until you ask us to remove yours.
- Bans and the admin log: deleted along with your account or waitlist entry.
- IP addresses for rate limits: an hour at most, in memory only.
- Database backups: 7 days, so anything we delete is gone from backups a week later.
Wherever you live, you can ask us to tell you what we hold about you, send you a copy, correct it, or delete it. You can also object to how we use it. Email privacy@iotcr.com from the address on your account. We handle requests by hand and reply within 30 days, and we may need to confirm the request came from you. Deleting your account deletes everything tied to it, including your characters and their progress, and can't be undone.
If you're in the EU or UK, we use your data to provide the game you signed up for, and we use your IP address and Turnstile to protect the game from bots and attacks, which is a legitimate interest. We send you news about the game only with your consent. You can complain to your local data protection authority.
Our servers are in the United States, so if you play from another country, your data is sent to and kept in the US.
You must be at least 13 to create an account or join the waitlist, or older if the law where you live requires it. We don't knowingly collect data from children under 13. If you think a child under 13 has given us their data, email privacy@iotcr.com and we'll delete it.
Every connection to our sites and servers is encrypted with TLS. Passwords are hashed with bcrypt, and codes, links, and sign-in cookies are stored only as hashes. Our database is encrypted, isn't reachable from the internet, and is backed up daily.
We don't track you across other sites, so a browser's Do Not Track setting doesn't change anything here.
We'll update this policy whenever we start using a new service that handles your data. When we change it, we'll update the date at the top. If a change is significant, we'll also email everyone with an account. Questions about this policy or your data? Email privacy@iotcr.com.