This is a translation; the Dutch version is the binding one.

Privacy Statement

Last updated: 23 October 2026

In short: we only store what we need to let you sign in and save your park, plus your play time and guest numbers to improve the game. No trackers, newsletter or forced ads. CoasterTycoon never emails you. Reward videos are currently turned off; if they are ever enabled and you choose to watch a reward video, Google will be involved. Read more below about ads and cookies and what is stored in your browser.

Who are we?

CoasterTycoon (coastertycoon.com) is a theme park game in your browser. CoasterTycoon is made by Netron ICT, Virulyweg 43-b, 7602 RG Almelo, Chamber of Commerce number 93536399. Netron ICT is responsible for your data. Questions? Email [email protected].

What data do we store?

• Your email address, only as your login name. We don’t verify it or send email to it. Other players never see it.
• Your password, only as a hash: a code that cannot be used to work out your password. Nobody can see it, including us.
• Your park name (for example, Coaster#48213). It is unique and intended as your public name in the game, for example on leaderboards. You can change it yourself (up to three times a day); the name must be appropriate. Each change, including your old and new name, is recorded in the admin log so the administrator can see what changed.
• Your park: your saved game and the previous version as a backup. The administrator can view your park to fix problems or take a look; viewing it does not change your park.
• A fair-play check: when you save, the server compares your park with the previous save to check that your money and counters match the amount of time you’ve played. If something doesn’t add up, the server saves a notice for the administrator (when it happened, which figures didn’t match and the last valid version of your park). The administrator can decide that everything is fine, restore your park or block your account. Until that decision is made, you won’t receive event rewards or appear on leaderboards. The saved valid version is deleted 30 days after the decision; the notice itself remains.
• Your gems: your balance, each transaction (when, how much and what for), your daily reward streak and what you’ve unlocked with them.
• One functional cookie that keeps you signed in, for up to 30 days after your last visit. The server stores only a hash of it (which cannot be reversed). CoasterTycoon itself does not use tracking, analytics or advertising cookies. If reward videos are ever enabled and you choose to watch one, Google may use advertising cookies (see Reward videos).
• Accounts created before October 2026 also have their old username.
• If you play without an account (as a guest), the server creates a guest account without an email address or password: it only has a park name, your park, your gems and the cookie that keeps you signed in. If you save your park with an email address and password, that guest account becomes your regular account, with the same park. Without an account, we keep your park for 7 days after you last played; after that, the server deletes the guest account and everything linked to it.
• Your last IP address. The server stores the last IP address used to access the game for each account, together with the time (it is updated when you sign in, start as a guest or play, at most once every ten minutes). We do this to prevent abuse, cheating and one person creating multiple accounts. Only the administrator can see it; other players never can. The address is deleted 30 days after you last used it, or sooner if your account is deleted.
• In addition, the game briefly keeps IP addresses in the server’s working memory to stop too many login attempts and other abuse; they disappear within a few minutes. When an account is created, the server also stores a code derived from your IP address, but not the address itself, until at most one day after the last account was created from that network (see “Protection against fake accounts”).
• If the administrator changes something on your account (for example, adds gems, changes your level, corrects your email address or sets a new password), this is recorded in an admin log using your user ID (a number), without your email address or password.

Protection against fake accounts

To stop bots from creating lots of accounts, the registration form has a hidden field that people don’t see (but bots often fill in), and the server checks that the form wasn’t submitted impossibly quickly. The hidden-field and speed checks also apply if you start playing without an account, along with a limit on the number of new guest accounts per network; the bot check only appears when you save your park. To limit new accounts from each network, the server keeps an unrecognisable code derived from your IP address, never the address itself (for an IPv6 address, only the first part linked to your connection). The code is held only in the server’s working memory, not in the database, and disappears no later than one day after the last account was created from that network. The server also checks whether the domain in your email address (the part after @) exists: it looks up only the domain and does not send an email. If the bot check is enabled, Cloudflare Turnstile checks your browser for signs of a bot during registration; you usually won’t notice. The server sends the result of that check and your IP address to Cloudflare.

Reward videos

You can pay for small actions in the game, such as moving a ride, stall or decoration, with gems or for free by watching a short advert. The Double your earnings with a video button in the Welcome back window works in the same way: you get your offline earnings a second time, for 0 gems. These videos are currently turned off. The feature is part of the game, but it is not active: there is no Get it free with a video button, and the game does not load anything from Google. These videos are only available if we enable them, and we will do so only after Google has approved the site for them. When they are turned off, you won’t see a Get it free with a video button, the game will not load anything from Google and no advertising cookies will be set. If they are enabled, the following applies; we will continue to explain this here and on the page about ads.

• Always optional. You never have to watch a video: the game doesn’t show ads on its own, and you can also pay with gems. The game only loads Google’s advert code if you tap Get it free with a video.
• Videos are provided by Google. Videos would be supplied by Google (Google Ireland Limited) through Google AdSense’s gaming section (H5 Games Ads). Once the advert code is loaded, Google receives, among other things, your IP address, information about your browser and device, and the address of the game page. Google may use cookies and similar technologies to show and measure ads and prevent fraud, and may process data outside the EU. Read how Google does this at policies.google.com/technologies/partner-sites.
• Consent. Before setting advertising cookies or personalising ads for visitors in the EU, Google shows a consent message. If you don’t consent, Google will show only limited, non-personalised ads or no video; you can always pay with gems.
• Withdrawing consent. You can change your choice or withdraw your consent at any time through Google’s privacy settings, which you can open on the game page, or by deleting this site’s and Google’s cookies in your browser.
• What we store. Google does not share data about you with us. The server only records that you paid for an action with a video (when and which action), alongside your gem transactions, so this can happen no more than thirty times a day. When you double your offline earnings, the server records only that transaction, so each offline earning can be doubled only once.

Questions about the videos? Email [email protected].

Advertiser videos

Businesses can arrange directly with us to show a short video (see advertising). You see one of these videos only if you choose to: when you select Get it free with a video or Double your earnings with a video. The game never shows it automatically, and you can always play without it. We show the video ourselves: nothing is loaded from the advertiser or Google, no cookies, pixels or tracking codes are added, and the advertiser receives no data about you. Advertiser videos are stored by Cloudflare (R2 storage in the EU) in a private storage area. A video is only available through a temporary address, valid for 15 minutes, which is given only to the game or the administrator. The video is then served from Cloudflare’s servers, so Cloudflare can see your IP address, just as it can for the rest of this site. In addition:

• What the server records. That you started and watched a video until the point where you could skip it, or until the end (short-lived proof used to grant your reward), and how many times you saw that video today, since you can see the same advert no more than ten times a day. This is linked to your account, kept briefly and deleted after two days.
• Language and country. We choose a video based on the language you play in and your country. We read the country from information Cloudflare sends with each request (derived from your IP address). We do not store your country with your account.
• Which videos you watched. For each advertiser’s video, we record on your account how many times you watched it up to the point where you could skip, how many times you watched it to the end, how many times you tapped the button showing the advertiser’s name, and when you first and last watched it. We keep this for no more than 30 days after the last view so the administrator can review campaigns and abuse. Only the administrator can see this; advertisers and other players never can.
• Figures for advertisers. Only daily totals by country (the Netherlands, Belgium and other countries): views and clicks. Never figures for individual players.
• Clicks. If you tap the Visit button showing the advertiser’s name, the game opens the advertiser’s own site with a label in the address that tells the advertiser you came from CoasterTycoon. The game also reports the click to our server so we can count it; we don’t store an IP address with it. The advertiser’s rules apply on their site.
• Why am I seeing this? The (i) button on the video explains who is advertising and why you’re seeing it: you play in Dutch and you’re in the Netherlands (or Belgium).

Advertiser data

When a business requests a campaign, it gives us a business name, contact person, email address, optionally a phone number, Chamber of Commerce and VAT numbers, a billing address, website address and video. We use this data to review the request, send an invoice, run the campaign and meet our record-keeping obligations. The advertiser receives an email with a personal link to a page showing campaign figures; anyone with the link can see them, so it should not be shared. We don’t store an IP address with a request or click; it is only kept briefly in the server’s working memory to limit abuse. We keep invoice data for as long as the law requires (seven years). Advertisers never receive player data.

Ads and cookies (Google AdSense)

CoasterTycoon is free. We may recover some of our costs through ads from Google AdSense. This section explains what that means for your data. It applies only if and when ads are shown; the game currently shows no ads, reward videos are turned off, and nothing interrupts your play.

• Who is responsible? Ads are supplied and shown by Google (Google Ireland Limited, for visitors in the EEA and the United Kingdom). Google decides how it uses the data it collects for this purpose. Google does not share data about you with us; we only receive figures about the ads themselves, such as the number of views.
• Which cookies? Google and its partners may use cookies, device IDs and similar technologies to show ads, measure their reach, prevent abuse and fraud, and, if you consent, personalise ads for you. Google may receive, among other things, your IP address, information about your browser and device, and the page you are viewing.
• Personalised or non-personalised. Personalised ads are based on things you have done before, for example on other websites. Non-personalised ads use only the page you are viewing now and your approximate location, not your previous activity. If you don’t consent to personalised ads, you’ll only see non-personalised ads.
• Consent in the EEA. Before setting advertising cookies, Google shows visitors in the European Economic Area and the United Kingdom a consent message (Google’s message from a consent platform certified by Google), where you can make a choice. Without your consent, we and Google will not set cookies to personalise ads. You can change or withdraw your choice at any time using the privacy and message settings Google shows on the page, or by deleting this site’s and Google’s cookies in your browser.
• More control. Use Google’s ad settings to turn off personalised ads for your Google account. Read about how Google uses data from sites that use its advertising services in Google’s policy for partner sites and Google’s Privacy Policy.
• Where ads won’t appear. Ads do not appear on the screen where you sign in or enter your email address, and we never use your email address or park to target ads. We do not place ads on this site’s information pages.

Cookies and storage in your browser

• One functional cookie keeps you signed in for up to 30 days after your last visit. It is needed to play the game, so we don’t ask for consent. It is not a tracking or advertising cookie.
• Browser storage (localStorage and sessionStorage) is used by the game for a few small things: a random number for the tab you’re playing in (so the game can tell if it is open in two tabs), which event messages you have already seen, and event dates. It does not contain an email address, password or park. If you clear this site’s data in your browser, this information starts over.
• Google cookies are only added if ads are shown and you consent, as explained above.
• Analytics are collected by us without cookies: see Play time and guests.
• You can always delete this site’s and Google’s cookies in your browser settings.

Play time and guests

To understand when and for how long people play (for example, to schedule activities and maintenance at quieter times and improve the game), we keep a few figures ourselves. We don’t use cookies or other providers for this, including Google Analytics.

• Your play time. While the game is open and visible, it tells the server about once a minute that you’re playing, and whether you clicked, tapped or typed anything in the previous 2 minutes (active). For your account, we store which minutes you played each day, whether you were active and how many minutes that adds up to. We do not record what you do in the game.
• Visitors to the home page and game page are counted hourly: how often a page was opened and how many different visitors viewed it. To avoid counting the same visitor twice, the server creates an unrecognisable code from your IP address and browser information, using a key that changes every day. Only that code is stored, and only until shortly after the end of that day (and in the server’s automatic backups until they are overwritten). For these counts, the IP address itself is not put in the database (your account’s last IP address mentioned above is stored separately). After that, only totals remain, with no information about you. Bots and search engines are not counted.
• How long? We keep play-time data for 12 months, then delete it day by day. If you delete your account, your play-time data is deleted straight away too. A visitor code disappears after the day ends; hourly totals contain no personal data.
• Who can see it? Only the CoasterTycoon administrator, in the admin screen. We don’t share these figures with anyone.

We do this because it is necessary to improve the game and keep it running properly (legitimate interest). If you object or want to know what data about you has been recorded, email [email protected].

Payments (Mollie)

If you buy gems, you pay through our payment partner Mollie B.V. (Amsterdam), for example using iDEAL. Mollie processes your payment details itself under Mollie’s Privacy Policy. We cannot see your bank details. We keep only what we need to provide your purchase and help with any problems: your user ID, the package, amount, date and Mollie payment number. We keep this data for 7 years as required by tax law.

Why?

We use your data to let you sign in, save your park on every device and keep track of your gems. This is necessary to provide the game (performance of our agreement). We prevent abuse and secure the site because this is necessary to keep the game safe (legitimate interest). Google advertising cookies (currently inactive) are only used with your consent. We don’t use your data for anything else or sell it.

How long?

We keep your data for as long as your account exists. If you play without an account (as a guest), we keep your park for 7 days after you last played; after that, the server deletes the guest account, your park, backup, gems, play time and sessions. An account that has never been used to play (with no park or gems) may be deleted after one day. If you ask us to delete your account, we immediately delete your account, park, backup, gems (including weekly leaderboard prizes), play time and sessions from the database. Copies in the server’s automatic backups disappear when those backups are overwritten. The admin log keeps your user ID and a record of what was done to your account. If your park name was changed, it also keeps your old and new park names. This information remains even after your account is deleted. A session expires after 30 days without a visit. Your last IP address is deleted 30 days after it was last used. Data about which advertiser videos you watched is deleted 30 days after your last view.

Where is your data stored?

The game and database are hosted by a provider in the Netherlands. Cloudflare (Cloudflare, Inc.) acts as a content delivery network (CDN) and security layer: your traffic, including your IP address, passes through its network, which also has servers outside the EU. As with any website, the hosting provider and Cloudflare may use technical connection data (such as your IP address and the time) to provide and secure the site.

Your rights

You can access, correct or delete your data and request a copy. Email [email protected], preferably from the email address linked to your account, so we know the account is yours. We will respond within one month. If you disagree with how we handle your data, you can complain to the Dutch Data Protection Authority.

Forgot your password?

CoasterTycoon does not send email, including password reset emails. Email [email protected] from the email address linked to your account, and you’ll receive a new password in a separate email to that address.

Under 16?

Ask a parent or guardian to read this with you before creating an account.

Changes

If anything changes about the data we store, we’ll update this page and the date at the top.