What Spillpoint knows about you
Written from the code, not from a template. Last checked 2026-09-21.
If you never sign in
Nothing about you is stored on our side beyond the web server’s access log: the time, the page, your IP address and your browser’s user-agent string. Those logs roll over and are deleted after 30 days.
Your browser keeps thirteen small values of its own. They never leave it, and we cannot read them remotely:
| Key | What it holds |
|---|---|
atlas_game | your points, streak, badges, the basins you hold, the places you follow and the ones you have stood at, the day you first played and how many cases you have opened today (the free allowance is counted here), your guesses and scores in The Drop and the side games, the rivers you have followed to the sea, and the place you chose to play near — a country, region or town picked from a list, never your position |
atlas_seen | which records you have already opened, so the game stops crediting the same one twice |
atlas_mis | which missions you have finished |
atlas_scan | your progress through the daily scan |
atlas_intro | whether you have seen the opening screen |
atlas_teach | which one-off explanations you have already been shown |
atlas_ads | how many of our own notices have been shown today, per slot, so the daily cap is a real cap |
spillpoint_played | that this browser has been to the board before, so the front page can step aside |
spillpoint_signed | a plain yes or no: whether you were signed in last time. It is not a credential — the sign-in itself is a cookie that pages cannot read |
spillpoint_plus | a plain yes or no: whether you subscribe to Plus, so no advertising is shown before your account has answered |
loop_s | kept only for this visit: if you arrived from one of our sister sites, which ad brought you and how long you have been active |
loop_ab | how many ad-blocker notices you have been shown, and when |
loop_d | how many ads for our sister sites you have been shown today, so the daily cap holds |
Clearing your site data removes all of them, and takes your progress with it.
The map is not tiles from a tile server. Every coastline, river, wind farm, railway and power station you see is drawn in your browser out of data files served from this machine, so no mapping company learns where you are looking. The typefaces are served from here too. Nothing on the page is fetched from anybody else.
If you sign in
There is no password to lose, because there is no password. You give an email address, we send a link, and the link works once and expires in thirty minutes.
| What is kept | Why |
|---|---|
| Your email address | to send the sign-in link, and to know whose account it is |
| A handle, if you pick one | how you appear on the leaderboard. Leave it blank and you appear as an initial |
| Points, streak, badges, basins held | the score |
| A line per scoring event — what you did, which record, which river basin, which day | so the same point cannot be claimed twice, and so a streak can be checked |
| Check-ins: which place, which basin, how far away you were in metres, and the accuracy figure your own device reported | to prove you were actually there, and to score it |
| Pictures you send, and their captions | so other people can see the place |
| Your answers to the daily questions | to score them, and to show how many people picked each answer |
| Your guesses in each day’s Drop, the score worked out from them, and which weekly league table you are in | to score the drop on our side and rank the week. The other players in your table see your handle and your weekly total, nothing else. Your score and your pin, rounded to about 10 km, also go into “how everyone did” for that drop: pooled with everyone else’s, never with a name, and only once five people have played it. Plus players can choose to show a ✦ mark next to their name in league tables; it stays off unless they turn it on |
That is the whole list. It is not sold, not rented, and not shared.
A cookie named atlas keeps you signed in for a year. It is
HttpOnly, so scripts on the page cannot read it, Secure, so it
only travels over HTTPS, and SameSite=Lax, so another site cannot make your
browser use it.
Your position is never written down
Checking in asks your device where it is and sends that coordinate to us once, so the distance to the place you are claiming can be measured. The coordinate is not stored. What is written to the database is the place, the distance in metres, and the accuracy figure — never a latitude or a longitude. The same holds for pictures: a picture is recorded against a place, not against a point on the ground.
You can refuse the position request. Everything else on the site carries on working; you simply cannot claim to be standing somewhere.
Pictures
Every picture is re-encoded the moment it arrives: opened, shrunk to at most 1600 pixels on its long side, and written out again as a new JPEG. Nothing from the original file survives that step — no camera make, no serial number, no GPS tag, no timestamp. What is left is the image.
It then waits in a queue until a person has looked at it. Until somebody approves it, nobody but you and a moderator can see it. Approved pictures are public, next to the place they show.
Reports you send
If you tell us something on the map is wrong, you do it signed in, and we keep: what kind of problem it is, which place or Drop it is about, what you wrote, and, if you moved a pin, where the map had it and where you put it. With it we keep a short note of the screen it came from (which map view, the size of the window and the kind of browser) so a broken screen can be found again. A moderator reads it next to your leaderboard name, or the first letters of your address if you have none, and how many of your earlier reports were right.
An approved correction is shown on the map for everyone, marked as coming from player reports; your name is not on it. The report itself stays with your account, so you can see what became of it, and goes when you delete the account. A report written before signing in waits in your own browser, not on our server, until you send it.
Games you play with others
Some games are shared: the country board, Drop Hour, party rooms, private leagues and First to Trace. For the ones that work without an account, your browser makes up a random number and keeps it inside atlas_game. It tells your turns apart from everyone else’s. It is not your name, your device or your address, and nothing links it to them.
| Game | What we keep | For how long |
|---|---|---|
| Country board | the random number, the country you chose to play for, how many lights you added and when | the week, and one more |
| Drop Hour | the random number and where you put your pin. Other players see the pins as unnamed circles. | eight weeks |
| Party rooms | the name you type and your pins, shown only to the people in the room | six hours from the moment the room was made |
| Private leagues | which leagues you joined. Members see your display name and your weekly drop points, never your email. | until you leave, or delete your account |
| First to Trace | the places you were first to trace. Your display name is shown on them to every player. | until you delete your account |
The plant you look after in Your Wind Farm and the cards you collect stay in your browser. A card you give to a friend is a link that carries the card’s number and nothing else.
Who else sees anything
- Brevo carries the sign-in emails and the opening-day email, so it receives your email address. Nothing else about you goes to it.
- Stripe takes payment if you subscribe to Spillpoint Plus. You pay on Stripe’s own page, so your card details and billing address go to Stripe and never reach Spillpoint. Spillpoint keeps only Stripe’s customer and subscription references, whether the subscription is active, and when the paid period ends. Stripe keeps its own invoices, as tax law requires.
- Google Analytics counts visits, but only as described under Analytics below.
- Nobody else. There is no tag manager, no embedded font, no map tile provider and no social widget on any page of this site.
Advertising
The only advertising on Spillpoint is for our sister sites: Aursee, Windrift and Wanderwort. Nobody pays to appear, and no advertising company is involved. The ads are served from this domain, set no cookie, and only appear in the pop-up windows, never on the map. We count views, clicks and time on the next site without identifying you: each record holds the time, the page, the ad and a code made from your connection with a key that is thrown away at the end of each day, so visits cannot be linked across days. Records are kept for 400 days. Plus subscribers see no ads.
If your browser blocks ads here, Spillpoint may ask you to allow them, at most once a day and never on the first page you open, with a notice you can close. The game works either way. Subscribing to Plus removes the question.
Nothing in the list above is handed to an advertiser.
The opening-day email
Before Spillpoint opens, the front page offers one email on the day it does. If you ask for it, we keep your email address, when you asked, and when you confirmed. Nothing is added to the list until you press the link we send; an unconfirmed address is deleted after seven days. We send one email when the site opens, with a one-click way off the list, and then delete the list. Asking for it does not create an account. To come off the list before then, write to hello@spillpoint.earth.
Children
The site is not aimed at children and asks nothing about age. If you are a parent and believe a child has signed in, write to the address below and the account and everything attached to it will be deleted.
Analytics
We count visits in two ways. Our server keeps daily totals from its own logs (pages,
referring sites, countries) with no cookies and nothing stored about you. We also use Google
Analytics: the pages you open, how you arrived, rough location, device and browser, and a few
moments in the game such as finishing a drop or sharing a score. Google keeps this under
cookies whose names start with _ga, for up to 14 months. It is not used for
advertising: Google signals and ad personalisation are off.
In the EU, EEA, UK and Switzerland, and wherever your device does not say where it is,
Google Analytics loads only if you press Accept. Elsewhere it loads by default. Wherever you
are, Privacy choices at the bottom of every page changes your
answer; Reject deletes the _ga cookies. Your answer is kept in this browser
(spillpoint_consent) for 12 months.
Where it is kept
On one rented server in Germany, inside the EU. Backups stay on the same machine. Nothing is copied to another country.
Who is responsible
The controller of your data is Nextin Media Limited, registered in Ireland under number 554885, registered office Grafton Building, 34 Grafton Street, Dublin 2, Ireland. Write to hello@spillpoint.earth. Its lead supervisory authority is the Data Protection Commission in Ireland, but you can complain to the authority in your own country instead.
Getting it back, or getting rid of it
The account panel has a delete button. Pressing it removes your address, your score, your event log, your check-ins, your pictures, your reports and our record of any Plus subscription in one go — not marked deleted, actually deleted.
If you pay for Plus, cancel it on the billing page first: it runs to the end of the period you have paid for, and the delete button will remind you. Stripe keeps its own invoices, as tax law requires.
For a copy of what is held, or for anything else, write to hello@spillpoint.earth from the address on the account. You also have the right to complain to your national data protection authority.
Changes
If this page changes materially, the change is dated here before it takes effect.
27 September 2026: added Google Analytics, with a choice before it loads in Europe, and cookie-free daily totals from our own server logs.
28 September 2026: added reports of mistakes on the map, and what they keep.
28 September 2026: added the opening-day email and what it keeps.
27 September 2026: The Drop now shows how everyone did; your score and your pin, rounded to about 10 km, are pooled into it without your name.
27 September 2026: deleting an account no longer cancels Plus by itself; cancel it on the billing page first.
27 September 2026: named the company responsible for your data and its supervisory authority.
23 September 2026: added the shared games (country board, Drop Hour, party rooms, private leagues, First to Trace) and what they keep.
23 September 2026: added The Drop, its weekly league for signed-in players, and the choice of where to play. The place you pick stays on your device; we never ask for or detect your location for it.
Spillpoint draws public European open data and is not an authority. Data: European Environment Agency and EMODnet (CC-BY 4.0), Copernicus EU-Hydro, JRC Hydro-power database, Eurostat GISCO (CC-BY, © EuroGeographics), OpenStreetMap contributors (ODbL 1.0), Natural Earth, Fraunhofer ISE energy-charts.info (CC-BY 4.0), contains modified Copernicus Sentinel data 2025. Modified. Back to the map ยท Privacy choices