1 in 8 Billion · 1in8b.life

Privacy policy

1 in 8 Billion has no accounts and is built not to ask for names or contact details. This page sets out everything we do handle, why, and where it is kept.

Effective: October 21, 2026

1. What we handle, why, how and for how long

Life records (the life you are living, the list of past lives and the full record of the latest 10 (of every past life in a browser with a keepsake pass, or in one that received the records moved from such a browser), your notes, settings, recent problems on this device (where a script error happened, a save, opening, payment check, memorial, video or move that did not work with a short code for why, the version and the time; 30 days, up to 12), the time crisis words were seen (for 30 days after it, no life on this device ends by or meets a suicide))

Purpose: Continuing a life, reopening past lives, reporting a problem
How it is kept: On your device (browser storage). Recent problems are never sent by themselves; they go along only when you send feedback or write to us with "Report a problem". Part of a life reaches our server only when you choose: when you share it (shared lives) or make a share link (the country, age and sex in the simulation, or, when you share “The life I wish for” or a life’s grain, its name, are in the link), or move your lives to another browser or phone (see "Moving my lives" below), or put up a memorial or carry a life with your keepsake pass (see the keepsake rows below)
How long: Until you clear the site data in your browser (some browsers, such as Safari, clear data of sites not visited for a while on their own)

Anonymous usage statistics: kinds of screens and actions (a life begins or ends, etc.) with details from the simulation (birth country, the country lived in now after a move abroad, age, auto mode, speed, the world chosen: past, today or future, and for a past world the decade of birth; when a life ends, the "today's theme" of the day it began and whether the life met it), how you arrived (link source, in-app browser type), device type and screen width, country of access (a country code derived from the connection; the address itself is not kept), a random number made fresh for each tab

Purpose: Understanding use, finding errors, managing server costs, the "living now" map on the first screen
How it is kept: Stored as hourly totals. The random number and the tab's current state are used only for the "online now" view and change on reload. No cookies, advertising IDs or IP addresses are stored
How long: Totals that cannot identify anyone; the "online now" view (random number included) forgets a tab within 5 minutes of its last signal (within 10 minutes from October 17, 2026)

Script error reports: version, screen, where the error happened and a short fingerprint (no error text, no address)

Purpose: Fixing errors
How it is kept: Hourly totals
How long: As above

Shared lives (optional): the simulation's story of that life (its name, country, age, sex), your words (up to 300 characters), language, time posted, "remember" and report counts, a random key for deleting your post (also kept on your device)

Purpose: Sharing lives with others; quoting them, without saying who wrote them, in posts introducing 1 in 8 Billion (social media and the like)
How it is kept: Public. Contacts, links, anything that looks like a school or an address, and insults are filtered out automatically, but no filter catches everything, so please leave out real names and anything that could identify you. To prevent abuse, the tab's random number is used briefly in server memory only
How long: Deleted at once when you delete it; a post hidden by reports or by us is kept so we can decide whether to restore it, until you delete it or ask us to

Moving my lives (optional): the life records in this browser (the list of past lives, the full record of the latest 10 (of every past life in a browser with a keepsake pass), the life in progress, your notes and farewells), the numbers and take-down keys of memorials put up from this device, the "country you were really born in" you chose, and whether this browser has a keepsake pass (the pass key is not sent)

Purpose: Moving your lives to another app's browser or a new phone (instead of a login)
How it is kept: Kept briefly on our server under a random code that works once. Nothing that says whose records they are (an account, an email, an IP address) is stored with them. Anyone holding the code can take them, so do not send it to anyone else
How long: Deleted as soon as they are taken, or after 3 days

Feedback (optional): kind of feedback, your text, play details (version and language, the birth country in the simulation, sex, family income group, age, cause of death, country of residence and job, the world chosen (with the birth year for the past), number of decisions, the current screen, device type and screen width, recent problems on this device as short codes), a nickname (optional)

Purpose: Fixing errors and improving the service
How it is kept: Sent through Google Forms and kept in Google Sheets. The operator reads and sorts feedback with the AI assistant Claude (Anthropic) and reproduces the problems it describes to fix them (see section 3)
How long: Deleted within a year after it is handled; quotes and summaries in the development records of what was fixed follow the GitHub row in section 3

Email (optional): your email address and message

Purpose: Replying, handling payments, refunds and problems
How it is kept: Mail to 1in8b.life addresses is forwarded by Cloudflare Email Routing to the operator's Gmail (Google) and kept there. If you write through "Report a problem", the version, device type and screen width, the state of your current life, recent problems on this device and (if you have a pass) its check code are filled into the message, and you can read and delete them before sending. From October 18, 2026, the operator reads and sorts these emails with the AI assistant Claude (Anthropic), checks the related payment records and drafts replies; the operator checks every reply before sending it and never leaves a decision such as a refund to the AI (see section 3). As it forwards mail to customerservice@, the server reads the subject and the start of the message and turns the sender's address and up to three addresses written in the message, with the forms they are likely to have been mistyped as at checkout (such as .con for .com), into irreversible hashes to find a keepsake payment. If the email asks about a refund, comes from an address that bought a keepsake pass (unless it was refunded), or seems to come from someone who paid with a mistyped form of their address, it sends the operator's Gmail one more email through Cloudflare's email sending, with the sender's name and address, the subject, the start of the message (up to 1,500 characters), the payment found (date and amount), that pass's purchases, refunds and memorials, what got in the way of its memorials in the last 30 days (see Keepsake pass below) and a draft reply. If an email from the very address that paid clearly asks for a refund within 30 days of payment, the server asks Stripe to refund that payment (sending only the payment number) and replies to the sender. The server never decides against a refund; the operator does. The server does not store the addresses or the message
How long: Deleted within a year after it is handled; payment and refund questions may be kept up to 3 years in case of disputes; quotes and summaries in the development records of what was fixed follow the GitHub row in section 3

Past support (closed on October 8, 2026): the supporter's name (or username) and email address Ko-fi shared with us

Purpose: Saying thank you (including opening a Keepsake pass as a thank-you)
How it is kept: Payment details were handled by Ko-fi and its payment providers; we never received them. Nothing new is collected
How long: In our Ko-fi account (under Ko-fi's policy) · deleted on request

Keepsake pass (optional): the payment notice Stripe sends us when a payment is done (email address, payment numbers, amount, and the name and billing country or address entered at checkout; of these we keep only the email hash, the payment numbers and the amount), the email you type to open the pass on another device, when the pass was first used, a pass key (kept on your device), what you put in a memorial (the name, country, age and sex in the simulation, the scenes and words of the last moments, your notes and farewell, the cover picture you chose, how you dressed it (the mood, frames, flowers and the moments shown), its title and opening and closing words, captions you rewrote, the list of things that life had, up to three of the statistics about the world that life met, and the grain of that life: how far it leaned within four pairs of words, the nearest name, a turn with age, and whether it was pushed to leave home) and a random key for taking it down (also kept on your device), what got in the way when putting up or changing a memorial (when, why, how many lines were left out, the version), candle and report counts, the fixed words visitors chose and when (never who left them). The device that made a memorial sends its number when the first screen opens, to fetch news of new candles and words (the numbers sent are not stored). So that its maker can change a memorial on any device, a device with the pass, or the device that made a memorial, sends the pass key or the memorial numbers and take-down keys it kept to fetch the memorials its maker put up (nothing new is stored). The House of Past Lives: how each room is decorated, the house name and whether it is open, and a random number used in the house's address

Purpose: Issuing and checking passes, refunds, running memorials, finding out why a memorial could not go up and answering questions about it, the House of Past Lives
How it is kept: Our server does not store email addresses: they are turned into a one-way hash and compared (payment records, email included, stay with Link and in the operator's Stripe account under Stripe's policies). Payment numbers are used only to avoid issuing a pass twice and to handle refunds. We never receive card or other payment details. Memorials are public (so are houses and rooms their makers open). Films, albums and record books are made on your device and never sent to us. From October 18, 2026, what got in the way when putting up or changing a memorial is kept with the pass's hash, and when the address that bought the pass writes to customer service, it is added to the note the operator gets. Lines of the simulation that our filter left out are kept apart, with the life's and the pet's names hidden and nothing about whose they were, and mailed to the operator by the hourly check
How long: Hashes, payment numbers and amounts, and purchase counts for as long as the service runs, so your pass keeps working; a memorial taken down from the device that made it is deleted at once, one we took down is kept so we can decide whether to restore it; what got in the way of memorials after 30 days, lines left out after 7 days; deleted on request

Carrying a life to another browser (keepsakes, optional): the whole record of that life (life record and your notes)

Purpose: Moving a life from an in-app browser such as KakaoTalk or Threads to Safari or Chrome
How it is kept: Kept briefly on our server under a random address that opens once; the browser that opens it gets the pass too (a browser holding another pass cannot open it)
How long: Deleted as soon as it is taken, or after 3 days

Cloudflare, which serves the site, may process connection data such as IP addresses for delivery and security; we do not store or view it. Fonts are served from our own domain, so opening the page sends nothing to other companies.

Legal bases (where the GDPR applies): our legitimate interest in running, securing and improving the service (anonymous statistics, error reports); your choice to use an optional feature (shared lives, feedback, email, past support, keepsakes).

2. Sharing

We do not give personal information to third parties, except when required by law through due process.

3. Service providers and international transfers

We use the services below, and information moves to their countries in the process. They protect transfers under their own safeguards (such as the Data Privacy Framework and standard contractual clauses).

Cloudflare, Inc.
USA (data centers worldwide) · privacyquestions@cloudflare.com

Information: Anonymous statistics, error reports, shared lives, lives being moved, keepsake hashes and memorials, email (forwarded; mail to customerservice@ is read to find the payment and write the summary, and not stored), connection data (such as IP addresses, which we do not store or view)
Purpose: Hosting the website and server, forwarding mail, sorting customer email, backups against failures (section 5)
When and how: Over the network whenever you use the site
How long: As listed above

Google LLC
USA · support.google.com/policies

Information: Feedback, email (Gmail)
Purpose: Receiving and keeping feedback and email
When and how: When you submit the form or send an email
How long: As listed above

Anthropic, PBC
USA · privacy@anthropic.com

Information: Feedback, email (the sender's name and address, subject, message and attached images), keepsake payment records related to the email (email address, date and amount, whether refunded)
Purpose: The operator uses the AI assistant Claude to read and sort feedback and email, reproduce and fix the problems they describe and draft replies, and to check payments and refunds. The operator checks every reply and sends it by hand
When and how: Over the network when the operator handles feedback or email (email from October 18, 2026)
How long: Under Anthropic's policy; the operator keeps these conversations set not to be used to train Claude (model improvement)

GitHub, Inc. (Microsoft)
USA · github.com/site/privacy

Information: The parts of feedback and email needed to record what was fixed (quotes or summaries, details from the simulation). Nothing that identifies the sender, such as a nickname, an email address or a name, is copied
Purpose: Keeping the service's source code and development records (a private repository)
When and how: When the operator fixes the service in response to feedback or email
How long: As development records, for as long as the service runs; removed on request

Ko-fi Labs Limited
United Kingdom · help.ko-fi.com

Information: What you entered on Ko-fi when you gave, until October 8, 2026
Purpose: Support payments (closed)
When and how: When you gave on Ko-fi
How long: Under Ko-fi's policy

Stripe, Inc. and its affiliates (including Link)
USA and elsewhere · stripe.com/privacy · payment help: support.link.com

Information: What you enter at checkout when you buy a keepsake pass (once paid, our server receives a payment notice, see section 1), and the payment number our server sends when it refunds
Purpose: Selling the pass. Link, run by Stripe, is the merchant of record: it handles payment, taxes, receipts and payment questions, and processes this information under its own policy. The operator can see payment records (email included) in the Stripe account
When and how: When you pay
How long: Under Stripe's and Link's policies

To avoid these transfers: shared lives, feedback and email and keepsakes are optional. To turn off anonymous statistics too, enable "Do Not Track" or Global Privacy Control in your browser; the site then sends no statistics signals (the first-screen map may show no other lives). Everything else works the same.

4. Children and teenagers

We do not knowingly collect personal information from children under 14 (16 in some countries). Please do not write names, contact details, schools or where you live in shared lives or feedback; we try to filter such details out automatically, though no filter catches everything, and if we learn that a child's personal information has reached us, we delete it. Under the terms of Link, the seller, the keepsake pass must be paid for by an adult; minors should ask a parent or guardian to pay. If a minor paid without a parent or guardian's permission, write to customerservice@1in8b.life for a refund.

For parents and guardians. 1 in 8 Billion is a life simulation made for ages 15 and up. It lives one person's life by real statistics, so death, illness, war and poverty, drinking, smoking, gambling, prison, violence at home and early marriage happen as they do in reality, and a past world tells of real history such as wars and mass killings. Drug dependence in adult lives, and sexual violence from age 15, also happen as often as the real statistics say, never shown in detail or how, always with where to find help, and never on shared cards or memorials (suicide happens from the teenage years on, as often as the real statistics say, never showing how or why, never named on shared cards or memorials, and always with where to find help). Players cannot talk to or contact each other, there are no ads, and paying never changes a life in the simulation. For players under 15, consider trying it together; questions are welcome at contact@1in8b.life.

Classroom mode. Teachers who want to use it in class can open classroom mode from 'Open in classroom mode' at the bottom of the first screen. A browser opened that way holds back content by our own guideline of ages 12 and up (no suicide, no violence or physical punishment at home, no drug dependence or sexual violence, no assisted dying in the family, no choosing to drink, smoke, gamble or commit a crime, and only today's world), and turns off shared lives, feedback, problem reports, moving records, keepsakes and memorials. So in classroom mode no names, contact details or pupils' words reach our server, and what is written in the pauses and parting words stays on the device. Only anonymous statistics that identify no one are sent, and not even those if the browser has "Do Not Track" or Global Privacy Control turned on. That classroom mode is on is kept in that browser only.

5. Deletion

Information is deleted without delay once its period ends or its purpose is met, in a way that cannot be recovered.

Copies against failures. So that nothing is lost to a failure or a mistake, the server's records (keepsake payments and passes, memorials, shared lives, anonymous statistics and operating records) have copies. Cloudflare, which runs the server, keeps 30 days of changes so the server can go back to a point within them; once a day we copy the records to storage inside the same Cloudflare account and keep each copy for 14 days; and we may download a copy from the admin page and keep it encrypted (deleted after 30 days). Memorials and shared lives are copied from October 18, 2026. So a post or memorial you delete or take down is gone from the site and the server at once, and from the copies within 30 days. Copies are used only to bring back records lost to a failure or a mistake.

6. Your rights

You can ask to see, correct or delete your personal information, or to stop or object to its processing: write to privacy@1in8b.life. We reply within 10 days.
You can delete a shared life yourself from the device you posted it on. A memorial can be taken down from the device that made it. What you delete is gone at once (from the copies kept against failures within 30 days, see section 5).
Life records on your device disappear when you clear the site data in your browser.
Anonymous statistics are totals that cannot identify anyone, so one person's part cannot be singled out.
You may also complain to your data protection authority.

7. Cookies and similar technology

We set no cookies (Cloudflare, which delivers the site, may set a strictly necessary security cookie, and the checkout uses cookies under Stripe's policy). Life records and settings are kept in browser storage (localStorage, and IndexedDB for the full records of past lives with a keepsake pass) and leave your device only when you share or carry a life, as set out in section 1. You can block or clear site data in your browser settings; continuing a life and past lives then will not work.

8. Security

All connections are encrypted (HTTPS), we handle only what is needed, IP addresses are not stored, the admin page needs a secret key, and a content security policy blocks outside scripts. Our server handles email addresses only as hashes.

9. Contact

Privacy officer: Jin’s Earth · privacy@1in8b.life

General questions: contact@1in8b.life
Payments, refunds (how refunds work) and problems while playing: customerservice@1in8b.life
Bugs and ideas: 'Send feedback' on the first screen

10. Changes

If this policy changes, we announce it on this page and in the update notes that day, and changes that work against you, such as handling more information or sharing it with more providers, at least 7 days before.

Coming change (from October 18, 2026): the copies kept against failures will include memorials and shared lives too, so something you delete or take down may stay in a copy for up to 30 days (section 5). Nothing more is collected.

Coming change (from October 24, 2026): a keepsake pass holder may turn on "Keep my past lives on the server too". A browser with it on has its life records (what "Move my lives" carries: the list of past lives, the full record of the lives you can see again, the life in progress, your notes and farewells, the numbers and take-down keys of memorials put up from that device, and the "country you were really born in" you chose) compressed and kept on our server (Cloudflare), so that they can be brought back by opening the pass again after the browser's data is cleared, or in another browser. Only the latest copy of each browser is kept (up to three browsers a pass), under the pass's hash and a random number each browser makes, and while it is on it is replaced when a life ends and about every 10 minutes during one. No email or IP address is stored with it. It is kept while you have the pass and deleted at once when you turn it off or the pass is refunded (from the copies kept against failures within 30 days, see section 5). Nothing is sent unless you turn it on.

Coming change (from October 17, 2026): the "online now" view (random number included) will forget a tab within 10 minutes of its last signal instead of 5. A visible tab will send its signal every 9 minutes instead of every 4, to cut server requests; nothing more is collected. A page left untouched for over 20 minutes sends no signal (this applies now).

Recent changes (October 8, 2026): we now describe the end of Ko-fi support and what we keep from past supporters, the House of Past Lives, and how the server reads mail to customerservice@ to find a payment and send the operator a summary.

Ready to be born again?

Be born