Privacy Policy

Last updated: October 31, 2026

Short version: you can play without an account, and then your farm is saved only in your own browser. We have no ads and we never sell your data. We count visits ourselves, anonymously and without cookies, and we use Google Analytics only if you allow it. If you make an account, we store only what the game needs: a player name, a protected password, your game progress and a few optional extras.

1. Who is responsible

Needle in a Haystack (needleinahaystack.io) is run by a private person in Germany. This person is the "controller" under the EU General Data Protection Regulation (GDPR):

Timur Atmaca
c/o Autorenglück #70028
Albert-Einstein-Straße 47
02977 Hoyerswerda
Germany
Email: support@needleinahaystack.io

We are not required to appoint a data protection officer. For any privacy question, just write to the email address above.

2. Playing as a guest

You can play the whole game without an account. Then:

• Your farm (coins, upgrades, tools, progress) and your settings are saved only in your browser on your device (IndexedDB and localStorage). We do not receive this save.
• A few small things are also kept in your browser: sound and graphics settings, the look of your farmer, which tips you have already seen, and a random guest race name like "Farmer_123". Your choice about Google Analytics is kept there too.
• If you clear your browser data, this save is gone. You can remove it at any time the same way.

Even as a guest, your browser talks to our server to load the game, to check for shared game events, to send the anonymous play statistics and, if you choose, to join an online race. See section 5, Anonymous play statistics and section 4.

3. Playing with an account

An account is optional. It lets you count your race wins, appear on the leaderboard, add friends and back up your farm online. Accounts are only for players who are 13 or older (see Children). When you make and use an account, we store:

When you make an account, you confirm that you are 13 or older. We check this box, but we do not store your age or birthday. We do not ask for your real name, address, phone number or photos. Please do not use your real name as your player name.

Sign in with Google

Instead of a password, you can sign in with your Google account, or connect it to your account later. This is optional; a player name and password work just as well.

• When you open the account window and our server offers Google sign-in, your browser loads the "Sign in with Google" button from Google (accounts.google.com). Google then receives your IP address and browser details, and it may see that you are signed in to Google in this browser. Google's button can use its own cookies for this. If you never open the account window, nothing is loaded from Google.
• When you press the button, you sign in at Google in a Google window. Google sends us a signed confirmation. It also contains your Google email and name, but we only keep the Google account ID and throw the rest away. We link your player account to this ID, never to your email.
• If this Google account is new to us, you pick a player name and confirm that you are 13 or older, just like in the normal sign-up. Until you finish, we store nothing.
• You can remove the Google connection in the account window at any time (if your account also has a password). Deleting your account also deletes the connection.

Google is a separate company and decides itself what it does with the data it gets when you use its button: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (for the EU/EEA and UK) and Google LLC, USA. Google LLC is certified under the EU-U.S. Data Privacy Framework. Google's privacy policy: policies.google.com/privacy. Legal basis: Art. 6 (1) (b) GDPR, because you ask to sign in this way.

4. Online races

In an online race, the server needs a few things to run the race fairly: your race name (your player name, or an automatic guest name like "Farmer_123"), your country flag if you have one (for guests it is guessed from your browser language), your farmer look, your position and actions in the race, and your connection. Other players in the same race see your name, flag and farmer.

For guests, all of this is kept only in the server's memory while the race room exists and is never written to our database. For account players, only the result (who took part, the places and who won) is saved to count wins. The race server checks moves for cheating (for example teleporting); suspicious finishes simply do not count.

5. Technical data, logs and security

• IP address: every time your browser loads the game or talks to our server, your IP address is sent. The server uses it to deliver the game and to stop abuse (for example too many sign-in tries or too many new accounts from one network). These counters are kept in memory for at most one hour.
• Web server logs: our web server may log the IP address, time, requested address and browser type of each request. These logs are deleted after 14 days.
• Game server logs: our game server logs short technical events (for example "a request took 20 ms" or an error message). These logs contain no IP address, no player name, no email and no passwords and are deleted after at most 14 days.
• Network code: to detect abuse such as many accounts made from one connection, we store a pseudonymous network code when you make an account and each time you sign in. It is a one-way keyed hash of your network (IPv4 address or IPv6 /64 prefix); we never store your IP address itself. The code is deleted with your account, and the code of a sign-in when that sign-in ends.
• Fair play checks: the server checks race wins, event finds, diamond rewards and cloud saves for things that are not possible in normal play (for example far too fast). A match is only marked for a person on our team to look at; nothing happens to your account automatically. If we find cheating, we can hide a win or lock the account.
• Security: the whole site uses HTTPS. Passwords are stored as salted scrypt hashes, session keys and reset codes only as hashes. Sign-in tries are limited.

We do not load anything from other companies: no fonts, no ads, no social media buttons. There are two exceptions: Google's sign-in button, and only after you open the account window (see Sign in with Google), and Google Analytics, and only if you allow it (see Google Analytics). We do not build profiles and make no automated decisions about you.

We may advertise the game on Google Search. These ads are shown by Google on its own pages. The link in an ad only tells our site that the visit came from Google Ads, and the game itself shows no ads and loads no advertising code.

Anonymous play statistics

To know how many people play, we count visits ourselves, for everyone, guests included. This uses no cookies and stores nothing on your device.

• What is sent: when you open the game and while you play, your browser sends small messages to our server: that the game was opened (with only the name of the website you came from, for example "reddit.com", and a campaign tag such as utm_source if the link had one), that you started playing, a race or the Daily Event, which campaign stage you completed or that you did a Prestige, your first hay sale and first upgrade, one note per minute of active play (numbered within the visit, to know how long a visit lasts), whether you use a touch screen or a mouse, and a rough region taken from your device's time zone setting (for example "DE" for Europe/Berlin, or only the continent). We do not look up your location from your IP address. No player name, no account and no save data.
• How it went: the same messages also say which kind of source this visit came from (ads, search, itch.io, direct or other), the coarse region when you complete a stage, and how far you got when you close the game (for example "left while loading" or "stage 3 done"). They also say how long the game took to load and how smoothly it ran, as coarse ranges such as "3-8 seconds" or "30-45 frames per second".
• Counting each visitor once a day: the server forms a one-way code (hash) from your IP address, your browser's user-agent text and a random value that is replaced every day. Your IP address itself is not stored. The random value of a day is deleted the next day, and the codes are deleted after 2 days. So nobody can tell who you are or follow you from one day to the next.
• What we keep: only counts per day (for example "120 visitors, 80 players, 15 finished stage 3"). These numbers are not about any one person. We may share them, for example with someone who wants to buy the game.
• Returning players: only if you allow Analytics (see below), the game also keeps the day of your first game in your browser (localStorage) and tells our server how many days ago that was (for example "7"). From these numbers we count how many new players come back after 1, 7 or 30 days. Switching Analytics off deletes this day.
• Not counted: crawlers, automated browsers and uptime monitors. Our own test devices can switch the counting off: opening the game with #nostats keeps this choice in the browser, #stats removes it.
• Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is to know how many people play and how far they get, so we can improve the game and plan the project. You can object at any time (see Your rights).

Google Analytics (only if you allow it)

If you press Allow in the small card on the main menu (or switch on Settings → Privacy → Analytics), the game uses Google Analytics 4, a web analytics service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). If you press No thanks or do nothing, Google Analytics is not loaded at all and nothing is sent to Google.

• Purpose: to understand how the game is played (for example which stages players reach, how long they play and which devices they use), so we can make it better.
• What happens: your browser loads Google's script from www.googletagmanager.com and sends usage data to Google: the page, game events (for example "stage completed", "race started", "account made"), device and browser type, screen size, language, the website you came from, and your approximate location, which Google derives from your IP address. A random ID is stored in the cookies "_ga" and "_ga_" plus our ID. We never send your player name, email address or account to Google.
• Switched off: Google signals and ad personalisation are turned off. We do not use the data for ads.
• Legal basis: your consent, Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.
• Google as our processor and the USA: Google processes the data for us under its data processing terms. Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has decided that the protection is adequate (Art. 45 GDPR).
• How long: Google Analytics keeps the event data for 14 months and then deletes it. The cookies end after at most 2 years, or when you switch Analytics off.
• Change your mind any time: switch off Settings → Privacy → Analytics in the game, or open the game to change your choice. From then on nothing more is sent, and the game deletes the _ga cookies. This does not affect what was sent before.

Google's privacy policy: policies.google.com/privacy.

6. Cookies and browser storage

We use one cookie, and only after you sign in or make an account: a session cookie (called "__Host-needle-session") that keeps you signed in. It is protected (HttpOnly, Secure, SameSite=Strict), is not used for tracking and ends 30 days after you last used it (at the latest 180 days after sign-in), or when you log out.

The game also uses your browser's storage (IndexedDB and localStorage) to save your farm and settings on your device, as described in section 2. Both the cookie and this storage are strictly necessary for the game you asked for, so they need no consent (German law: § 25 (2) no. 2 TDDDG). Your choice about Google Analytics is stored there as well.

Only if you allow Google Analytics, Google's cookies "_ga" and "_ga_" plus our ID are set, and the game keeps the day of your first game (see Google Analytics and Anonymous play statistics). Switching Analytics off deletes them. Our own anonymous play statistics use no cookies.

7. Emails

We only send emails if you gave us an email address, and only for two reasons: a password reset link you asked for, and a warning if someone tries to make a new account with your address. We never send newsletters or ads. These emails are sent through the mailbox of our email provider checkdomain GmbH, Große Burgstr. 27/29, 23552 Lübeck, Germany (checkdomain, Germany). Our server does not keep a copy of sent emails.

Many players are young, so a parent's email address is perfectly fine.

Contact form

If you write to us with our contact form, we process your name (optional), your email address, the topic you pick and your message, only to answer you. Legal basis: Art. 6 (1) (b) GDPR when your message is about the game or your account, otherwise Art. 6 (1) (f) GDPR (our legitimate interest in answering questions). Our game server does not store the message: it passes it on once, as an email, to our mailbox at checkdomain (see above). We keep it there as long as we need it to answer you, at most 12 months. To stop spam, the server counts messages per network for at most one hour (see section 11).

8. Why we may use your data (legal bases)

For people in the EU, EEA and UK, the GDPR requires a legal reason for each use:

• To provide the game and your account (sign-in, cloud save, races, leaderboards, friends, password reset): Art. 6 (1) (b) GDPR, because you asked us to provide this service.
• To keep the game safe and fair (IP-based limits, logs, anti-cheat checks, the warning email when your address is reused): Art. 6 (1) (f) GDPR. Our legitimate interest is a secure, working game without cheating or abuse.
• Anonymous play statistics (daily counts, see Anonymous play statistics): Art. 6 (1) (f) GDPR. Our legitimate interest is to know how many people play and how far they get.
• Google Analytics (only if you allow it): your consent, Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw it at any time in Settings.
• Your optional extras (email address, country): you choose to give them; you can remove or change them any time in the account dialog.
• Legal duties, if any apply (for example answering a lawful request by authorities): Art. 6 (1) (c) GDPR.

9. Who else gets data

We do not sell, rent or share your personal data for advertising. Only these service providers handle data for us, under a data processing agreement and only on our instructions:

• Hosting: Hostinger, Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus (servers in Boston, USA). Our server stands in Boston, USA.
• Email: checkdomain, checkdomain GmbH, Große Burgstr. 27/29, 23552 Lübeck, Germany, Germany, only for the emails described above.
• Google (only if you use "Sign in with Google", as a separate company, not on our behalf): see Sign in with Google.
• Google Analytics (only if you allow it): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor (see Google Analytics).
• Backups: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (encrypted SSH transfer to a storage box in Falkenstein, Germany), encrypted copies of the database for disaster recovery.

We may also have to share data if the law requires it (for example a court order).

10. Servers in the USA (international transfer)

We live in the EU, but our game server is in the USA. So data about you (as listed above) is stored and processed in the USA. To protect it, we rely on the EU Standard Contractual Clauses (European Commission decision 2021/914, module two: controller to processor) that are part of our hosting provider's data processing addendum (Art. 46 (2) (c) GDPR). Data is sent only over encrypted connections. You can ask us for a copy of these safeguards at support@needleinahaystack.io.

If you allow Google Analytics, data may also go to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR), see Google Analytics.

11. How long we keep data

• Account data (all items in section 3): as long as your account exists.
• Cloud save: the current and the previous version; older versions are deleted automatically.
• Sessions: end 30 days after last use (at the latest 180 days after sign-in) and are then deleted within minutes.
• Password reset links: valid for 30 minutes, deleted one day after they expire.
• Contact form messages: in our mailbox at checkdomain until we have answered, at most 12 months; not stored on the game server.
• Guest race data: only in memory while the race room exists.
• IP-based abuse counters: in memory, at most one hour.
• Logs: game server logs at most 14 days; web server logs 14 days.
• Anonymous play statistics: the random value of a day until the next day, the visitor codes 2 days; the daily counts are kept, because they are not about any person.
• Google Analytics (only if you allow it): 14 months at Google; its cookies at most 2 years or until you switch Analytics off.
• Backups: copies of the database are kept for at most 30 days. Deleted accounts disappear from them when the old backups expire.
• Your guest save: stays in your browser until you or your browser delete it. We cannot see or delete it.

12. Deleting your account

You can delete your account yourself, at any time, inside the game:

1. Open the account dialog (the button with your name at the top, or Menu → Account).
2. Choose Delete Account… and then Delete Account and Cloud Data.
3. For your safety, your sign-in must be no older than ten minutes; otherwise, log out, log in again and repeat.

This immediately and permanently deletes your account, your cloud saves, sessions, friends and friend requests, your race places, your diamonds and looks, your Google connection and any open reset links. Wins you gave to other players stay counted for them. The farm saved in your browser stays, so you can keep playing as a guest. Tip: download a copy of your cloud save first (Download Cloud Save). If you cannot sign in any more, email us from the address stored in your account, or tell us your player name, and we will help.

13. Your rights

You have the right to:

• get a copy of the data we have about you (Art. 15 GDPR) and receive it in a common format (Art. 20; your cloud save can be downloaded directly in the game);
• have wrong data corrected (Art. 16) and data deleted (Art. 17);
• limit how we use your data (Art. 18);
• object to uses based on our legitimate interests (Art. 21);
• withdraw any choice you gave us at any time, for example switch off Analytics in Settings or remove your email address in the account dialog;
• complain to a data protection authority, for example the one where you live or the one responsible for us: the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

Just email support@needleinahaystack.io. We answer within one month. To protect your account, we may ask you to prove it is yours (for example by writing from the stored email address). These rights are free of charge.

14. Children

Needle in a Haystack is made to be fun and safe for everyone, including kids.

• Under 13? Play as a guest. Guests can play everything, including races, without giving us any personal information. Guest names are automatic (like "Farmer_123").
• Accounts are only for players who are 13 or older. The sign-up form asks you to confirm this. If you are under 13, the game does not create an account.
• We do not knowingly collect personal information from children under 13, as required by the U.S. Children's Online Privacy Protection Act (COPPA). There is no chat in the game, and nobody can send you messages through it.
• Parents: if you think your child under 13 made an account, email us at support@needleinahaystack.io with the player name. We will delete the account and its data.
• In the EU: if you are under 16, please ask a parent or guardian before making an account or pressing "Allow" for Analytics.

15. For players in the USA

We do not sell personal information and do not share it for targeted ("cross-context behavioral") advertising, and we do not use it for profiling. Because we are a small private, non-commercial project, U.S. state privacy laws such as the California Consumer Privacy Act (CCPA/CPRA) most likely do not apply to us, as we are below their size thresholds. Still, we offer everyone, wherever they live, the same rights described in section 13: to know what we store, to get a copy, to correct it and to delete it. We will never treat you differently for using these rights. We do not track you across websites. Google Analytics runs only if you press "Allow"; without that, nothing is sent to Google, whatever your "Do Not Track" or Global Privacy Control setting is.

16. Changes and contact

If the game changes (for example, if we add purchases), we will update this policy and change the date at the top. For important changes we will also tell you in the game.

Questions? Write to support@needleinahaystack.io. See also our Terms of Use and Legal Notice.