Privacy Policy

This policy describes how IslandDex (the “app”, the “site”, hereafter “we”) collects, uses and protects the personal data of users of the mobile app and the website, in accordance with the General Data Protection Regulation (GDPR). Browsing the service does not require an account and does not involve creating any profile.

In short: if you create an account (via Google or Epic Games), we record and store on our servers the data described below (account identifier, username, content you publish, and depending on the features you use: favorites, likes, rewards, notifications…), to provide you the service and for as long as your account exists. The full detail — what data, for what purpose, for how long — is given section by section below, with a summary in section 8. You can delete your account and this data at any time (see here).

1. User account

To publish maps, like or favorite a map, report content, claim a creator name or receive alerts, you need to create an account through a third-party sign-in provider: Google or Epic Games. We never receive your password. Depending on the provider you choose, we collect your account identifier with that provider, your username or display name and, where applicable, your email address, as well as technical data related to authentication (account creation date, sign-in session). This data is necessary to perform the contract between us (providing the service).

We also ask you, once, what you're here to do on IslandDex (a player looking for maps, a map creator, or both). This answer, optional and editable, is attached to your account and is used only to improve and guide the service; it is never shared with third parties. This question is also asked of accounts created before it was introduced.

We also ask you to choose a username, unique on IslandDex, including for existing accounts. It's this username, and never the name of your Google or Epic Games account (often a real name), that is shown to others. You can also add an avatar from your dashboard: the image is checked automatically to screen out inappropriate content, then heavily compressed (128px, metadata stripped) before being stored. Username and avatar are deleted with your account. If your username matches a creator name, we may suggest, in your dashboard, that you claim it; this is only a clue, with no effect until you prove it.

2. Maps, likes, claims and dashboard

When you submit a map (title, description, genre, map code, thumbnail), this information is public and displayed in the community feed visible to every app and site user. Since the service is community-driven, you can submit another creator's map; submitting a map does not make you its creator. The link between your account and the maps you've submitted is recorded, as are the maps you like (a “like” is attached to your account, without being publicly displayed alongside your identity) and the maps you favorite. Your favorites list is strictly private: it is only visible to you and is deleted with your account. Only the total number of people who've favorited a map is shared with its creators (those who've claimed its name), never who they are.

When you submit a map, we query Epic Games' public API with the map code to pre-fill its title, tags, genre and creator name, and to display its public stats; no personal data is sent to Epic Games in this process. You remain responsible for the content you publish and guarantee that you hold the necessary rights over the information provided. We reserve the right to remove content that doesn't comply with our terms of use or Epic Games' own rules.

If you claim a creator name (by temporarily adding a code provided by the service to the title of one of your islands), we re-read the island's title through Epic Games' public API, then record the link between your account and that creator name, along with the claim date. The creator name shown is the one already published by Epic Games; your account name (Google or Epic Games) is never shown. The temporary code is deleted once the claim is completed or after 7 days. Your dashboard, accessible only while signed in, gathers the maps you've submitted, the ones carrying a creator name you've claimed, and their stats.

Only creators who've claimed a map's creator name can edit its information (title, genre, tags, description, thumbnail). When several people have claimed the same creator name, they form a team: each member sees, in their dashboard, the other team members' username, avatar and claim date. This list is never public and is only visible to team members.

We also record alerts shown in the site's and app's bell: approval or rejection of one of your maps' thumbnail by moderation, a new member joining your team (with their username). They are kept for 90 days at most, are only visible to you, and are deleted with your account; the matching alert that mentioned your username to a teammate is also deleted. You can also choose, from your profile, to receive these alerts as notifications on your Android phone or browser, even when the app or site is closed. This option is off by default: permission is only requested if you turn it on. To do this, we store your device's technical identifier (“token”), provided by Firebase Cloud Messaging (Google), linked to your account. The notification text passes through this service. The token is deleted when you turn the option off, when you sign out of the device, when it becomes invalid, and with your account. No alert is ever sent by email.

The rewards program records, for each account, the points and experience (XP) earned when a map you've submitted is approved or when you verify a creator name, or when you open the site or app while signed in (once a day, for the login streak), along with the date and nature of each gain. So for each day you sign in, we record the date and the platform used (website, Android or iOS), with no time, device identifier or location. This data is also used for overall activity statistics (number of active accounts per day and per platform) reviewed by the service's administrators; these statistics are numbers only. This log is used to compute your rank, badges and points balance. The detail (history, points balance, badges) is only visible to you, in the “Rewards” tab of your dashboard; it is kept for as long as your account exists and deleted with it. If a rewarded map is deleted, the corresponding reward is taken back.

Public leaderboards (monthly, all-time, and a hall of fame of the top 10 of every month) display your username, avatar, rank and XP. This information is visible to everyone, including without an account, and indexable by search engines; your account name (Google or Epic Games) and email address never appear there. You can choose, at any time, from the “Rewards” tab, to stop appearing in these lists: the choice applies within a few minutes. The monthly results are kept indefinitely for the hall of fame; if you delete your account, your place is kept but no longer linked to you (it shows as “Deleted account”). If you finish in the top 10 of a month, an alert (and a notification if you've turned them on) lets you know.

Referrals give you a personal code, which you can share (as a code or a link). When someone enters your code, we record the link between the two accounts (referrer and referee) and its status (pending, rewarded). The referrer only sees numbers (how many people used their code, how many were rewarded), never their identity; the referee likewise doesn't know their referrer's identity. A code received through a link is kept in your browser until you sign in, then erased. The referral link is deleted with either the referrer's or the referee's account; points already paid to the other person keep no data about you.

Your rank (computed from your XP) is shown next to your username in public leaderboards, in your team's member list (visible only to its members) and next to your username in your own space. If you choose not to appear in leaderboards, your rank is no longer shown to others. When you redeem points or podium days for featuring one of your maps, we record the spend (points, date) in your rewards history and the end date of the feature on the map; this information isn't public, only the “featured” label is. The same applies when you unlock a themed cursor (one at a time for points, or the pack of four as a purchase): we record the spend and the id of the unlocked cursor, so you can find it again on another device. Which cursor is currently shown, though, stays a local preference on your browser (see point 6): we don't know which one you use.

3. Images, moderation and reports

Thumbnails you upload are compressed then automatically scanned on our servers to detect sexual content; this scan uses no third-party service and sends your image to no one. An image flagged as sensitive, or one that couldn't be scanned, is set aside and manually reviewed by an administrator before publication (which can take up to 24 hours); a rejected image is deleted from our servers.

Any signed-in user can report a map. We then record your account identifier, the reason chosen and, if provided, your details. This information is only visible to administrators, is never shared with the creator or the person who submitted the map, and is deleted with the map or, if the report is dismissed, kept for abuse management (legitimate interest: safety and prevention of unlawful content) until your account is deleted. An administrator can permanently delete a map, along with its images, likes and reports.

4. AI-generated thumbnails

This feature is currently suspended: no data is sent to Mistral AI while it's inactive, and we'll update this policy when it's turned back on. Here's how it's meant to work. Thumbnail generation and regeneration rely on a third-party provider, Mistral AI. When you start a generation, your map's metadata (title, genre, description) and the prompt you may have edited are sent to this provider to produce the image. No account data (email, payment method) is sent to Mistral AI in this process. Mistral AI's handling of this information is governed by its own terms and privacy policy. Each generation uses one credit from your account; if the generation fails technically, the credit used is automatically refunded.

A second feature, UEFN Tools, is live: it generates a thumbnail that follows Epic's official rules (format, render style, overlay text) from your scene description, an optional Fortnite skin name, and, if you choose, a source image you provide. These are sent to a second third-party provider, Google (Gemini model), to produce the image; no account data (email, payment method) is sent to it. Each generation uses credits from your account (topped up by buying a pack, see “Payments and purchases” below); if the generation fails technically, the credits used are automatically refunded. Generated thumbnails are kept and public (visible in your “My generations” space, the first step toward a future community gallery of creations); they are deleted when your account is deleted.

5. Payments and purchases

On the mobile app, purchases (generation credit packs, featured slots) are processed directly by the app stores' in-app purchase system (Apple App Store, Google Play), which verify the purchase and report it to our server. On the website, purchases (paid featuring, the themed cursor pack) are processed directly by Stripe: you are redirected to a payment page hosted by Stripe, then brought back to the site once payment is complete. We store no banking data: this information is handled directly by the payment platforms, by Stripe and by the stores. We receive from these providers the information needed to validate your purchase (transaction ID, product purchased, status, and depending on the purchase the map identifier and the duration chosen, or the cursor pack) in order to credit your account, activate the purchased feature, or unlock the purchased cursors. Sale terms (price, right of withdrawal) are detailed in our terms of sale.

6. Local storage and cookies

When you sign in, a session token is kept on your device: in your browser's local storage for the site, and in your phone's secure storage for the app. It's required for sign-in to work and serves no tracking purpose. The site also remembers, for the length of a browsing session, that you've chosen “Later” for the question described in point 1. To let you know about news, the site (once signed in) and the app store on your device the date of the latest news you've seen and of the last check (at most once a day): this information stays on your device, is never sent to our servers and serves no tracking purpose. If you choose your language (French or English) from the site's switcher, that choice is remembered for a year in a cookie (“islanddex-lang”) used only to show the site in the right language, with no tracking. The mouse cursor currently shown (sniper bullet, normal mouse, or a themed cursor you've unlocked) is likewise remembered only on your device, with no tracking; only the list of unlocked cursors is kept on our servers (see point 2), so you can find them again on another device. As of today, we don't use any advertising cookie or audience-measurement tool; should this change (for example, showing ads), we would ask for your consent beforehand and update this policy.

7. Hosting and providers

Your data is processed by the following providers, only for the purposes described above:

• Vercel: hosting of the site and API, and image storage (Vercel Blob).
• MongoDB Atlas: database (accounts, maps, likes, reports).
• Google and Epic Games: authentication, depending on the provider you choose.
• Google (Firebase Cloud Messaging): notification delivery, only if you turn them on; Google may process this data outside the European Union, under its standard contractual clauses.
• Mistral AI: thumbnail generation, at your request (suspended feature).
• Google (Gemini model): AI thumbnail generation (UEFN Tools), at your request.
• App Store, Google Play and Stripe: purchases.

Some of these providers may process data outside the European Union; such transfers are then governed by the safeguards required by the GDPR (standard contractual clauses or an adequacy decision).

9. Minors

The service is intended for people aged 13 and over. Under 15, creating an account, any purchase and the resulting data processing require the authorization of a parent or legal guardian, in accordance with French regulations.

10. Your GDPR rights

Under the GDPR, you have a right of access, rectification, erasure, restriction, objection and portability over your personal data, as well as the right to withdraw your answer to the usage question at any time.

Account deletion: you can delete your account yourself, at any time, from the app or the site (account menu, “Delete my account”), as explained on the Delete my account page. Your account, likes, reports and claims are then deleted; the maps you've submitted are kept but are no longer linked to you. You can exercise your other rights, or request deletion if you can no longer sign in, by writing to us at the address below; we reply within one month. You also have the right to lodge a complaint with the CNIL (www.cnil.fr) if you believe your rights aren't being respected.

11. Contact

For any question about this policy or to exercise your rights, you can contact us at: contact@kurtystudio.fr.

12. Changes to this policy

This policy may be updated to reflect the product's evolution (new features, new providers). The last-updated date is shown at the top of this page; in case of a significant change, we'll let you know within the service.