Privacy Policy
Waitlist at coinisland.io · Last updated: 19 October 2026 · Version 2026-10-19
This policy explains what we collect when you join the Coin Island waitlist, why, and the rights you have under the EU/UK General Data Protection Regulation (GDPR) and Turkey's Personal Data Protection Law No. 6698 (KVKK).
1. Who we are
The data controller is the Coin Island team, operator of coinisland.io. Contact: [email protected].
2. What we collect
| When you… | We store |
|---|---|
| join with email | your email address, the time and version of your consent, your language |
| join with Connect X | only your X user ID, @username and profile picture URL. We ask for the read-only permissions users.read and tweet.read (X requires both to show who you are). We do not read your posts, followers or messages, we never post for you, and we discard the access token right after reading your profile. |
| use an invite link | which member invited you |
| arrive from an ad or link | campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_content, utm_term) and the address of the page that linked to us (without its query string) |
| any sign-up | a one-way, keyed hash of your IP network address (not the IP itself), used only to stop spam and fake referrals |
We do not collect wallet addresses, payment data, your real name, or precise location on the waitlist.
3. Why, and on what legal basis
- To keep your place in line and contact you about the launch and early access — your consent (GDPR Art. 6(1)(a); KVKK Art. 5(1) explicit consent). Joining with X is also based on your consent when you approve the connection.
- To prevent abuse (bots, duplicate and self-referrals) using the hashed IP network — our legitimate interest in a fair waitlist (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)).
- To measure which campaigns bring people using the campaign tags — aggregate statistics only, our legitimate interest.
We do not sell your data, use it for advertising profiles, or make automated decisions with legal effect about you.
4. Emails
We may send you a confirmation email and, later, launch and early-access news. Every email lets you unsubscribe. You can also withdraw consent any time by writing to us — this does not affect anything we did before.
5. Who receives it
Only service providers that run the site for us: our hosting/server provider, Cloudflare (network and security) and, when you choose Connect X, X Corp. (for the sign-in itself). These providers may process data outside Turkey and the EEA; where required we rely on appropriate safeguards such as standard contractual clauses (GDPR Ch. V) and, for transfers from Turkey, the safeguards of KVKK Art. 9.
6. How long we keep it
Until the waitlist and early-access phase ends, and at most 12 months after the game's public launch — or sooner if you ask us to delete it or withdraw consent. Spam-prevention hashes are kept with the sign-up they belong to.
7. Cookies and local storage
No advertising or analytics cookies. Your browser keeps a random member key in local storage (ci.wl) so the page can show your place in line, plus the campaign tags you arrived with. Connect X sets one short-lived, necessary cookie (ci_wlx, 10 minutes) to complete the sign-in safely.
8. Your rights
You can ask for access to, correction or deletion of your data, restriction of or objection to processing, data portability, and you can withdraw consent at any time (GDPR Art. 15–21; KVKK Art. 11). Email [email protected] from the address you signed up with, or tell us your X username. We reply within 30 days. You may also complain to your data protection authority — in Turkey the Personal Data Protection Authority (KVKK Kurumu), in the EU the authority of your country.
9. Age
The waitlist is for people aged 16 or over. If you are younger, please do not sign up.
10. About collectibles
Coin Island is a game. Mentions of a free genesis character NFT for early members describe a possible free, cosmetic item; it is not guaranteed, not an investment, and carries no promised value or return.
11. Changes
If we change this policy we will update the date above; material changes that need new consent will be asked for again.