Privacy Policy

Ice Coast Revival. Effective date: July 27, 2026.

This policy explains what we collect, why, and the choices you have. The game is available worldwide, and this policy applies to all players wherever you play. Some regions, including the EEA, the United Kingdom, Brazil, Canada, Australia, and certain U.S. states, grant additional rights, which we describe in Section 10.

1. Who we are

Ice Coast Revival (“the Game,” “we,” “us”) is an independently developed ski-resort tycoon game, playable in your web browser and, where available, as an iOS app. For privacy law in the European Economic Area (EEA), the United Kingdom, and regions with similar laws, Firn LLC is the operator and “data controller” responsible for your personal information. Firn LLC’s address is 82 Wendell Ave. Ste 100, Pittsfield, MA 01201, USA. For any privacy question or request, wherever you live, contact Firn LLC at privacy@icecoastrevival.com.

2. Information we collect

Email address (only if you sign in)

Accounts are optional and never required to play. If you choose to sign in, you give us an email address. You can sign in with an email and password, or with a one-time “magic link” we email you. When you set a password, it is handled and stored securely (salted and hashed) by our authentication provider, Supabase; we never see or store it in plain text. We use your email to sign you in, to associate your saved games with your account, to send you transactional emails needed to operate your account (the sign-in link itself, an email-confirmation link if your account requires one), and, if you submit feedback while signed in, to attach that feedback to your account so we can follow up. Your email is never shown publicly, and neither is your feedback. We do not send you marketing email from this address unless you separately opt in; see the next section. If you delete your account, your email is removed from your past feedback.

Marketing emails (opt-in only)

Occasional product news, such as major updates or announcements, is sent only to players who explicitly ask for it. This is different from the transactional emails described above: transactional emails keep your account working and are sent regardless of any marketing choice, while marketing emails are entirely optional and off by default.

• How you opt in. The preference is offered during account creation and on the signed-in account page. Each offer is optional and off unless you turn it on. If you opt in while creating an account by password, magic link, Google, or Apple, we record your choice on your account with a server-side timestamp.
• How you withdraw it. Once signed in, the same preference appears as a toggle on the account page opened from the “Innkeeper’s ledger.” Unchecking it takes effect immediately. Every marketing email we send will also include an unsubscribe link that does the same thing without requiring you to sign in first, once that mailing capability is live (see the provider note below).
• Fail-safe by design. If you have never made a choice, no preference row exists for your account at all, and you receive no marketing email. A preference row is created only the moment you affirmatively opt in.
• Who sends it. Marketing email, when it begins, will be delivered by a reputable email service provider acting on our instructions as our processor, bound by a data-processing agreement; where your data leaves your region, it is protected by standard contractual safeguards. Until sending begins, opting in records your preference but no marketing email is sent.
• Regional consent rules. Where the law requires affirmative opt-in consent for marketing email (including the EEA and UK under ePrivacy/GDPR rules, and Canada under CASL), the checkbox above is that consent, and you can withdraw it as easily as you gave it, per Section 9’s consent-withdrawal right. U.S. commercial email law (CAN-SPAM) requires a valid physical postal address in marketing messages; every marketing email we send will include one in its footer.

Signing in with Google (optional)

Instead of an email and password, you can choose “Continue with Google.” If you do, Google shares a basic profile with us through our authentication provider (Supabase): your name, your email address, and your Google account’s profile identifier. We use this only to create and sign in to your account and to store your cloud saves, the same purpose as email sign-in, just without a separate password. We do not request access to your Google contacts, Drive, Gmail, Calendar, or any other Google service, and we never post anything to your Google account. You can revoke our app’s access at any time from your Google Account permissions page, and you can delete the account you created with us at any time (see Section 9).

Signing in with Apple (optional)

You can also choose “Sign in with Apple.” Apple shares the minimum it is designed to share: a stable, app-scoped identifier, and, only on your very first authorization, the name and email address you choose to share (Apple lets you share a private relay address instead of your real one). If you sign in again later without Apple’s email field present, we recognize you by that same stable identifier rather than treating you as a new signed-out player. We use this only to create and sign in to your account and to store your cloud saves. You can manage or revoke the app’s access from your Apple ID account settings, and you can delete the account you created with us at any time (see Section 9).

Saved games

The Game stores your progress so you can pick up where you left off:

• On your device. Every player’s saves are stored locally in your browser or app (using IndexedDB). This stays on your device and is not sent to us unless you sign in.
• In the cloud. If you sign in, your saves are also stored in our database so they sync across your devices. Each save is tied to your account and is only accessible to you (enforced by row-level security). A save contains game state only (such as your resort layout, in-game day, and progress) plus a label you give it.

Public leaderboard (Daily Challenge)

The Daily Challenge mode has an optional public leaderboard. You can play and see your own score without an account. If you choose to post a score, you first sign in and pick a username. From then on, that username and your posted scores, the number of skiers, the hill, the date, and your standing in the daily and monthly rankings, are publicly visible to anyone viewing the leaderboard. That public display is the purpose of a leaderboard, and it is one of the few places where something you provide is shown to other players. Your email address is never shown there. Please choose a username that is not your real name or other personal information; usernames pass a basic filter, but you control what you pick. We also store a small non-identifying verification record with each posted score (a game seed and content hashes) to detect invalid submissions; it contains no personal information. Posting is limited to two attempts per day; we keep your best. If you play on the iOS app and have Game Center enabled on your device (this is independent of which method you use to sign in to your Ice Coast Revival account), your weekly-challenge score may also be mirrored to Apple’s own Game Center leaderboard as a display surface; Apple’s Game Center is a separate service governed by Apple’s own privacy policy, and that mirroring never gates or replaces our leaderboard.

Social profile and friend connections (optional)

If you opt in to Reciprocals, other participating players can see a profile containing your username, your chosen founder, and an optional bio. Your featured career statistics are shared according to the visibility you choose: Everyone or Reciprocals only. You can send, accept, decline, or remove friend connections called Reciprocals; the connection list is visible only to its participants. Turning social features off hides your profile in the Game and stops new connection requests. Database access rules enforce these visibility choices for your profile, your career statistics, and your friend connections. You can choose which saved career supplies your public stat card. You can also change your social name, with successful changes limited to once per month.

Feedback

If you submit feedback (bug reports, ideas, or other notes) through the in-game feedback button, we store the text, your chosen category, your app version and platform. Every submission is private: only you and the development team can read it. Other players cannot view it or react to it. The same random, pseudonymous device identifier used for gameplay telemetry accompanies each feedback submission. If you were signed in when you submitted it, we also attach your account so we can follow up and so a developer reply can reach you. If you submit without an account, the device identifier lets that installation retrieve its submissions and any developer replies. Deleting your account removes its attachment from past feedback.

Push notification tokens (iOS app only)

If you previously signed in on the iOS app and allowed notifications, we may hold one device token for your account. Push delivery is currently parked, and no weekly notifications are sent. If delivery is re-enabled in the future, registering again from a new device will replace the stored token for your account. If you decline or later disable notifications in iOS Settings, we cannot reach that device.

Device preferences

We store a few small preference flags in your browser’s or app’s local storage, for example, your audio settings, whether you have dismissed certain one-time prompts, and, briefly, an unconfirmed marketing-checkbox choice while a sign-up redirect is in progress (cleared automatically once sign-in completes or after fifteen minutes, whichever comes first), and a temporary checkout request identifier while checkout is pending (cleared when ownership becomes active). These stay on your device, are not personal information, and are never transmitted to us as such.

Pseudonymous gameplay telemetry

To understand how the Game is played and where to improve it, we record a small number of gameplay events, for example, that a session started, which mode or founder was chosen, and how a run ended. This is first-party telemetry stored in our own database; we do not use Google Analytics or a cross-site tracker, and we set no cookies for it. Events are keyed by a random, pseudonymous device identifier kept in your browser’s or app’s storage (IndexedDB). It is not a tracking cookie. The same identifier accompanies feedback, and feedback can be linked to your account when you are signed in. For that reason, the identifier is not anonymous in the strict sense. Telemetry event payloads contain no name or email address. You can opt out of this telemetry at any time (see Section 5).

Technical data handled by our providers

To deliver the Game, our hosting and database providers (see below) automatically process standard technical information such as your IP address and basic request details. They use this to serve the site, keep it secure, and prevent abuse. We do not use this data to build a profile of you or to track you across other sites.

3. What we do not do

• We do not use tracking or advertising cookies.
• We do not use advertising analytics, tracking pixels, or any cross-site tracker. Our gameplay telemetry is pseudonymous, cookieless, and first-party. Cloudflare may provide cookieless, privacy-preserving aggregate traffic metrics as part of hosting and securing the Game.
• We do not show ads or use ad networks.
• We do not sell or rent your personal information, and we do not share it for cross-context behavioral advertising.
• We do not embed advertising, cross-site tracking, fingerprinting, or third-party social scripts.
• We do not send you marketing email unless you have actively opted in, and we do not enroll you in marketing simply because you created an account.

4. How we use information, and our legal bases

We use the limited information above only to:

• sign you in and keep you signed in (if you choose to have an account);
• store and sync your saved games;
• send you occasional marketing email, only if you opt in;
• operate, maintain, and secure the Game; and
• respond to your requests and support questions.

Legal bases (EEA, UK, and similar laws). Where the law requires us to have a “legal basis” to process your personal information, we rely on:

• Performance of a contract, to sign you in and to store and sync your saved games when you choose to create an account. We can’t provide the account you asked for without this.
• Consent, for marketing email. Checking the opt-in box is that consent; leaving it unchecked means we do not rely on any basis to send you marketing email, because we simply do not send it. You can withdraw consent at any time (Section 2’s marketing section and Section 9).
• Legitimate interests, to keep pseudonymous gameplay telemetry so we can understand and improve the Game, and to keep the Game secure and prevent abuse. You can object to telemetry at any time (see Section 5). Telemetry event payloads contain no name or email address, and we balance these interests against your privacy.
• Legal obligation, where we must retain or disclose limited information to comply with the law.

We do not rely on consent to set tracking cookies, because we do not use any.

5. Cookies and device storage

We do not use tracking or advertising cookies, and we do not show a cookie banner because we do not set tracking cookies. Here is everything we store on your device and why:

• Strictly necessary. Your local saved games (IndexedDB), small preference flags (such as audio settings, dismissed one-time prompts, and a brief in-progress marketing checkbox flag described in Section 2), and what’s needed to keep you signed in if you have an account. The Game can’t work as intended without these, and they stay on your device.
• Pseudonymous telemetry and feedback identifier. A single random identifier kept in your browser’s or app’s storage (IndexedDB), not a cookie. We use it to record gameplay events, attach private feedback, and let the same installation retrieve that feedback and any developer reply. Signed-in feedback can also be linked to your account, so this identifier is pseudonymous rather than strictly anonymous. We rely on our legitimate interest in improving the Game.

Your choice. If you’d prefer we don’t collect pseudonymous telemetry from your device, email privacy@icecoastrevival.com and we’ll honor your opt-out. We’re also building a self-serve, in-game opt-out. You can clear all device storage at any time from your browser or app settings.

Some privacy laws, including the EU/UK ePrivacy rules, treat any non-essential storage on your device as something you can decline. The opt-out above is how to do that today.

6. Marketing communications: consent, regions, and unsubscribing

This section gathers, in one place, everything about the optional marketing emails introduced in Section 2, since Google Play and similar policies ask that this be explained clearly and separately from how we run your account.

• Marketing versus transactional. A transactional email is one needed to operate the account you asked for: a magic sign-in link, an email-confirmation link. We send those regardless of your marketing choice, because without them the account feature you asked for would not work. A marketing email is optional product news you asked to receive; we send those only if you checked the opt-in box (or later turned the toggle on) and never otherwise.
• How consent is captured. You can opt in from the unchecked checkbox during account creation or from the toggle on the signed-in account page. The account-creation choice applies the same way regardless of whether you use a password, magic link, Google, or Apple. Opting in creates one record, tied to your account, with a server-stamped timestamp; that record is the only place your preference lives, and only your account holds it.
• How to withdraw consent. Uncheck the equivalent toggle on your signed-in account page at any time, no reason needed. We process an unsubscribe request, whether from the in-app toggle or a future email unsubscribe link, promptly, and in any case within the time your local law requires.
• Regional rules we follow. In the EEA and UK, and in Canada under CASL, we treat marketing email as requiring your prior, affirmative consent, which is exactly what the unchecked-by- default box provides; we do not pre-check it or bundle it with another action. In the United States, CAN-SPAM does not require opt-in consent but does require truthful headers, a working unsubscribe mechanism, and a valid physical postal address in the message, and every marketing email we send will include all three; because we already require opt-in everywhere, U.S. players get the same protection as anywhere else.
• International transfer for the marketing list. Your preference record itself (opted in or not, and when) is stored in Supabase alongside the rest of your account, as described in Section 7. Once we select an outside mailing provider to actually send marketing email, we will name it here, along with where it processes data and the transfer safeguard that applies; until then, no marketing email is sent, so no such transfer occurs.

7. Service providers and international data transfers

We rely on a small number of service providers, who process data on our behalf to run the Game:

• Supabase, provides our authentication (email, Google, and Apple sign-in), the database that stores cloud saves, your marketing-email preference, feedback, and leaderboard entries. See the Supabase Privacy Policy.
• Cloudflare, hosts and delivers the Game and protects it from abuse. Cloudflare may provide us with cookieless, privacy-preserving aggregate traffic metrics. See the Cloudflare Privacy Policy.
• Apple, provides Sign in with Apple, push notification delivery (APNs), and, if you use it, Game Center, on the iOS app. Apple processes data under its own privacy policy as an independent controller for those services.
• Marketing email provider: an email service provider acting as our processor, engaged when marketing sending begins; see Section 6.

Where your data is processed. Supabase and Cloudflare process data in the United States. If you are located outside the United States, for example in the EEA, the UK, Canada, Brazil, or Australia, your information may be transferred to and processed in the U.S. Where the law requires a transfer safeguard, we and our providers rely on appropriate mechanisms, such as the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant) or other lawful transfer tools these providers offer.

8. How long we keep data

Local saves and preferences stay in your browser or app until you delete them (for example, by clearing site or app data) or your device evicts them. For everything we hold on our servers:

These periods are our current, owner-set retention practice rather than a fixed legal maximum; we keep personal information only for as long as we need it for the purposes in this policy, and delete or anonymize it after.

9. Your rights and choices

You can:

• Play without an account, simply do not sign in. We still collect the pseudonymous gameplay data described above unless you opt out.
• Access or export, your saves are downloadable from within the Game, and you can request a copy of the account data we hold.
• Opt in or out of marketing email, using the checkbox during account creation or the toggle on your signed-in account page, at any time.
• Delete, delete cloud saves in-game, sign out at any time, or schedule deletion from the signed-in account page. The in-game request marks your account with a cutoff 30 days later, and you can cancel before that cutoff. Purging then removes your account, cloud saves, profile, friends, marketing preference, and push token; it removes your account’s attachment to feedback and entitlement transaction records rather than deleting that history outright, so product and accounting records stay intact without identifying you. Local saves on your device are never touched.
• Correct, change your social name from the account page once per month or ask us to correct other information associated with your account.

Depending on where you live, you may also have the right to object to or restrict certain processing (including our telemetry), to receive a portable copy of your data, and to withdraw consent where we rely on it (including marketing email, at any time and by the simplest method we offer, the in-app toggle). To exercise any of these, email privacy@icecoastrevival.com. We’ll respond within the time your local law requires (for example, within one month under the GDPR/UK GDPR, or 45 days under California law), and we will not discriminate against you for exercising your rights.

If you believe we’ve mishandled your personal information, you can complain to your local data-protection authority, for example, your EU member-state supervisory authority, the UK Information Commissioner’s Office (ICO), Canada’s Office of the Privacy Commissioner, Brazil’s ANPD, or Australia’s OAIC. We’d appreciate the chance to address your concern first.

10. Region-specific privacy rights

We offer the access, correction, and deletion choices above to everyone. Some regions add specific rights:

European Economic Area and United Kingdom (GDPR / UK GDPR): we process your data on the legal bases in Section 4, support the rights in Section 9 (access, rectification, erasure, restriction, portability, objection, and withdrawing consent), and transfer data as described in Section 7. Marketing email requires your prior opt-in consent under these laws, which is exactly how Section 6 works. You can contact us directly at the address above and may also lodge a complaint with your local supervisory authority or the UK ICO.

U.S. residents (including California): because we do not sell or share personal information and do not use it for targeted advertising, there is no “Do Not Sell or Share My Personal Information” action to take. We also do not track you across other websites, so we honor “Do Not Track” and Global Privacy Control browser signals by default. California residents may request access to or deletion of their personal information using the contact above.

Canadian residents: we handle personal information in line with PIPEDA and applicable provincial laws (including Quebec’s Law 25). Marketing email follows Canada’s Anti-Spam Legislation (CASL): opt-in consent, an easy way to withdraw it, and an identified sender, as described in Section 6. You may access, correct, or withdraw consent to our use of your personal information; withdrawing consent for the email tied to your account means we can no longer offer you cloud-synced saves.

Brazil (LGPD): you have the right to confirm and access your data, to correct, anonymize, port, or delete it, and to information about how we process it. Exercise these via the contact above; you may also contact Brazil’s National Data Protection Authority (ANPD).

Australia (Privacy Act / APPs): you may request access to and correction of your personal information, and may complain to the Office of the Australian Information Commissioner (OAIC). Please contact us first at the address above.

Everywhere else: wherever you live, you’re welcome to make the same access, correction, and deletion requests. We apply these choices to all players.

11. Children’s privacy

The Game is intended for a general audience and is not directed to children. You must be at least 13 years old to create an account, or older where your local law sets a higher minimum age for digital consent (for example, up to 16 in parts of the EEA under GDPR Article 8, and 16 in some other countries). We do not knowingly collect personal information from children below the applicable age. If you believe a child below that age has provided us an email address, contact us at privacy@icecoastrevival.com and we will delete it.

12. Security

We use reputable providers and security measures (such as encrypted connections and access controls) to protect your information. No method of storage or transmission is perfectly secure, but we work to keep what little we hold safe. Because some saves live only in your browser or app, we recommend downloading important saves as a backup.

13. Changes to this policy

We may update this policy from time to time. When we do, we’ll revise the effective date above. A material change, such as this one, gets a “what changed” notice at the top of this page for a reasonable period, and where practical an in-game notice as well.

14. Contact us

Questions, requests, or concerns? Email privacy@icecoastrevival.com.