Last updated: 5 November 2026
Privacy Policy
Who we are. SYMBOT LTD (trading as SYM.BOT, a company registered in Scotland under company number SC856218) is the controller of your personal data when you use XMESH World: Glass Island, Wenenby 3010 when it opens, xmesh.world and the Glass Island agent tool. Contact: [email protected].
1. What we collect
| What | Why | Lawful basis (UK GDPR) |
|---|---|---|
| Account: an account id; your Apple or Google user id; your email and name, if Apple or Google shares them (Apple can give a private relay address) | to sign you in and keep your account | contract |
| Game data: your saves and progress, items, pet, home, credits balance and its history (the ledger: every credit earned, spent, bought, refunded or lost in play) | to run the game and keep your credits right | contract |
| Purchases: order ids, amounts, currency, status, and Stripe's ids for the payment and customer | to sell you credits, keep accounts and handle refunds and chargebacks | contract; legal obligation (tax and accounting records) |
| Security and fair play: sign-in events, IP address (for rate limits and abuse), signs of cheating | to protect accounts and keep the game fair | legitimate interests |
| Technical and gameplay events: device and browser type, performance, errors, how the game is played (rooms, rounds), with a device id we derive (not your name or email) | to fix bugs and improve the game | legitimate interests |
| Support: what you write to us | to answer you | contract; legitimate interests |
We never receive or store your full card number: Stripe handles the card. The Glass Island agent tool keeps its memory of past games on your own computer; it is not sent to us.
We don't sell your data, and we don't use it for third-party advertising.
2. Who processes it for us
| Processor | What for | Where |
|---|---|---|
| Stripe | payments, invoices, fraud checks | UK, EU and US, under Stripe's data processing agreement |
| Cloudflare | the website, content delivery, DDoS protection | global, under Cloudflare's data processing addendum |
| Vultr | our game and account servers | United States (New Jersey), under Vultr's data processing agreement |
| Apple, Google | sign-in, if you choose them (they are separate controllers under their own policies) |
Where data goes outside the UK, we rely on adequacy regulations or the UK International Data Transfer Addendum or Agreement.
3. How long we keep it
- Account and game data: while your account is open. After you close it, we delete or anonymise it within 30 days, except as below.
- Purchase and ledger records: 6 years after the end of the financial year they belong to (UK tax and company law).
- Security logs: 90 days.
- Technical events: 13 months, then aggregated.
4. Your rights
Under the UK GDPR you can ask us to:
- give you a copy of your data (access);
- correct it;
- delete it (where we don't have to keep it, for example purchase records);
- restrict or object to our use of it (for legitimate interests);
- give it to you in a portable form.
Write to [email protected]. We reply within one month. You can also complain to the Information Commissioner's Office (ico.org.uk), but please contact us first.
5. Children
The game is for players aged 13 and over. If you are under 18, a parent or guardian must agree to any purchase. We design for younger players with the ICO's Age Appropriate Design Code in mind:
- high privacy by default;
- no profiling for advertising;
- no public sharing of your data.
If you believe a child under 13 has an account, contact us and we'll delete it.
6. Cookies and local storage
xmesh.world and the game use your browser's local storage to keep you signed in (an access token and a refresh token) and to save game progress. We don't use advertising cookies. To see whether people play, we count visits to xmesh.world and games played in the browser (when a game starts and ends, how long it lasted and whether the crew got out), with the IP address they came from. These are kept as security logs (90 days). We don't use third-party analytics.
7. Changes
We'll post changes here with a new date, and tell you in the game or by email if a change is significant.