Privacy Policy

1. Who we are

Harvest Tycoon (the website harvesttycoon.com, the game and the installable app) is operated by:

Millstone
Acacialaan 18, 2282 AX Rijswijk, the Netherlands
Chamber of Commerce (KvK) number: 89795857
Email: info@harvesttycoon.com

Millstone is the controller for the personal data described in this policy. In this policy, “we”, “us” and “our” mean Millstone, and “you” means anyone who visits the website or plays the game.

2. What we collect

Your account

• Your email address and password. Your password is stored in hashed form by our sign-in provider; we cannot read it.
• Your player name (chosen by you, or picked for you at random) and the avatar you choose.
• When your account was created, whether you confirmed your email address, and when you last signed in.
• Technical sign-in data kept by our sign-in provider for security, such as your IP address, browser type and session times.

Your game

• Your farm and progress: fields, crops, buildings, inventory, coins, diamonds, experience points, level, quests, achievements and statistics.
• A record of recent game actions with their times, so that the server can check them and repair problems.
• When you were last active, used to show whether you are online.
• Where and on what you last opened the game: your IP address, your browser and device type, the country of your device’s time zone and the language you play in. We use this to keep the game fair and secure (for example to spot one person playing with several accounts) and to see where our players come from and which languages they play in. Only your latest visit is kept: each new visit replaces it.
• Farm families: the families you join or create, your role, your contributions, invitations, and the help, gifts and requests you exchange with family members.
• Farm events: whether you took part, your progress, your ranking and your rewards.
• The chat: the messages you send (in the global chat, your family chat or a private chat), with your player name, avatar and the time; which chats you have read; the farmers you block; reports you make about a message; and your chat settings. If a moderator mutes or bans you from the chat, we keep that decision and its reason.
• Gifts or corrections we add to your account ourselves, for example after a support request.

Purchases

When you buy diamonds or the Starter Pack, you pay on a checkout page run by Stripe. Stripe collects your payment details and any information it needs for the payment (such as your email address) under its own privacy policy. We receive and keep: what you bought, the price and currency, the payment status, the dates, and Stripe’s reference numbers for the checkout and the payment, linked to your account. We do not receive your full card number.

Reminders (only with your permission)

• Push notifications: if you allow them, we store the push address your browser gives us (a web address and encryption keys), your browser or device type, and whether delivery worked.
• Daily email summary: if you switch it on, we send it to your account email address.
• News and offers by email: only if you switch on News & offers by email in Settings, or tick the box for it when you confirm your email address. Both start off. We keep whether you said yes and when you last changed it.
• Your reminder choices, your time zone and your preferred hour, and when we last sent you a reminder.

Push notifications only arrive after you allow them on your device. Once allowed, the reminders for private messages, your daily gift and crops & goods ready are on; email reminders and news and offers by email are off until you switch them on. You can change each of them at any time in the game under Settings.

When you contact us

If you email us, we keep your message, your email address and our reply for as long as we need them to help you.

Website visits

When you visit the website, our hosting and database providers process technical data such as your IP address, browser type and the pages or services requested, in order to deliver them and keep them secure. Google Analytics and the Meta Pixel also receive data when you visit; see section 8.

3. Signing in with Google or Facebook

You may be able to sign in with a Google or Facebook account instead of an email address and password. This is optional; you can always use your email address.

• If you choose Google or Facebook, that service asks you to agree to share your name, email address and profile picture with Harvest Tycoon, together with a unique identifier for your account at that service.
• We use the email address and the identifier to create your account and to sign you in. Our sign-in provider stores the name and profile picture with your sign-in details; the game does not show them. Other players see only the player name and avatar you choose in the game.
• We do not receive your Google or Facebook password, and we do not get access to your contacts, friends, messages or posts. We never post anything on your behalf.
• If the email address matches an existing Harvest Tycoon account, you may be signed in to that same account.

Google and Meta process your data under their own privacy policies. You can remove Harvest Tycoon’s access at any time in your Google account or Facebook settings. That stops future sign-ins through that service but does not delete your Harvest Tycoon account; see section 11 for that.

4. How we use your data, and on what legal basis

• To provide your account and the game: signing you in, saving your farm, the leaderboards, farm families, events and support. Legal basis: performance of our agreement with you (Article 6(1)(b) GDPR).
• To process purchases and deliver what you bought. Legal basis: performance of our agreement with you.
• To send account emails, such as the confirmation link and password reset. Legal basis: performance of our agreement with you.
• To send reminders by push notification or email, only after you allow push notifications on your device or switch on email reminders. Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time in Settings or through the unsubscribe link in each email.
• To send news and offers by email (new features, events and offers in Harvest Tycoon), only after you have said yes to that separately. Legal basis: your consent (Article 6(1)(a) GDPR and Article 11.7 of the Dutch Telecommunications Act). You can withdraw it at any time in Settings or through the unsubscribe link in every email; withdrawing does not affect emails we sent before.
• To keep the game fair, secure and working: preventing cheating, fraud and abuse, finding and fixing errors, and understanding how the game is used from our own game records. Legal basis: our legitimate interests in a safe, fair and working game (Article 6(1)(f) GDPR).
• To understand how visitors find and use Harvest Tycoon and to measure our advertising, with Google Analytics and the Meta Pixel, only if you accept cookies. Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time under Cookie settings.
• To keep financial records and meet other legal obligations. Legal basis: legal obligation (Article 6(1)(c) GDPR).
• To establish, exercise or defend legal claims. Legal basis: our legitimate interests.

We do not use your data for automated decisions that have legal or similarly significant effects on you.

5. What other players can see

Harvest Tycoon is a multiplayer game. Other signed-in players can see your player name, avatar, level, your game statistics on the leaderboards, whether you have VIP, and whether you are online. Members of your farm family also see your contributions and the help, gifts and requests you exchange. Farm event rankings show the player name, avatar and level of the top players. Your email address is never shown to other players.

The chat. Messages in the global chat can be read by every signed-in player, family messages by the members of that family, and private messages only by the two farmers in that chat. Moderators (players we trust to keep the chat friendly) and we can read a message that someone reports, and can delete it or mute or ban its sender from the chat; a chat ban never affects your farm. You can block a farmer, and you can switch private messages off under Settings. Please do not share personal details such as your address or phone number in the chat.

Choose a player name that does not reveal more about you than you want to share. You can change it at any time under Settings.

Invite a friend. Your invite link contains a short code, not your email or account ID. If someone starts Harvest Tycoon with your link, you see their player name and level in your list of invited friends, and they see your player name. When they reach level 10 within 30 days, you both receive diamonds.

6. Who helps us

We use the following service providers. They process personal data on our behalf or, where stated, under their own privacy policies.

• Supabase: database, sign-in and server functions. Our project is hosted in the European Union (Frankfurt, Germany).
• Vercel: hosting of the website.
• Stripe: payments. Stripe also processes payment data under its own privacy policy.
• Resend: delivery of our emails.
• Push services of your browser or device maker (for example Apple, Google, Microsoft or Mozilla): delivery of push notifications, if you allow them.
• Google: Google Tag Manager, Google Analytics and, if you use it, Google sign-in.
• Meta: the Meta Pixel and, if you use it, Facebook sign-in.

We may also share personal data when the law requires it, to protect our rights, the safety of players or the security of the game, or as part of a merger, sale or transfer of the game or our business. In that last case this policy will continue to apply to your data unless you are told otherwise.

We do not sell your personal data.

7. Data outside the EU

Our database is in the European Union. Some of the providers above, including Vercel, Stripe, Resend, Google and Meta, may process data outside the European Economic Area, for example in the United States. Where that happens, we rely on the transfer mechanisms those providers offer, such as the EU–U.S. Data Privacy Framework or the European Commission’s standard contractual clauses.

8. Cookies and local storage

Storage the game needs

The game itself does not set cookies. It stores a few small items in your browser’s local storage so that it works:

The website also installs a small service worker so the game can be installed as an app and can show push notifications. It keeps one small page to show when there is no internet connection and, for the number on the app icon, how many unread chat messages you have. It does not store copies of the game or your data.

Analytics and advertising

Only if you choose Accept in the cookie banner, our website loads Google Tag Manager, which runs Google Analytics and the Meta Pixel. We use them to understand how visitors find and use Harvest Tycoon and to measure our advertising. If you decline, or make no choice, these tools are not loaded.

• The events our game sends to these tools contain only general facts, such as the type of device, which step of sign-up was reached, your level or which diamond pack was bought. They never include your email address, player name or account ID.
• Google and Meta do receive your IP address and information about your browser and device, and they set cookies to recognise your browser, such as _ga and _ga_… (Google Analytics, by default up to two years) and _fbp (Meta Pixel, by default up to 90 days). Google and Meta process this data under their own privacy policies, and Meta may use it for its own purposes, such as advertising.

You can change your choice at any time with Cookie settings at the bottom of the home page or under Privacy in the game’s Settings. When you decline, we remove the Google Analytics and Meta Pixel cookies that were set on our own domain, and if the tools were already running, the page reloads so they stop. You can also block or delete cookies in your browser settings; the game works without them. You can also use Google’s Google Analytics opt-out browser add-on and manage ads from Meta in your Facebook ad preferences.

The privacy policy and account deletion pages do not load these tools.

9. How long we keep data

• Account and game data: for as long as your account exists. We may delete accounts that have not been used for a long time.
• After you ask us to delete your account: we delete your personal data or make it anonymous within one month, except the data below that we must or may keep.
• Purchase records: for as long as Dutch tax and accounting rules require, generally seven years.
• Chat messages: 30 days, then they are deleted automatically. Notifications in the chat: at most 60 days. Reports that have been handled: 90 days.
• Push notification addresses: until you switch push notifications off or sign out on that device, or until the push service tells us the address no longer works.
• Daily email summary: until you switch it off or unsubscribe.
• Emails with us: for as long as needed to handle your question, and afterwards only if we need them for legal reasons.
• Technical logs: for a limited period, according to the settings of our hosting and database providers.
• Analytics data: according to the retention settings of Google Analytics and Meta.
• Backups: deleted data can remain in backups for a limited time until those backups are replaced.

We may keep data for longer where that is needed to establish, exercise or defend legal claims, or to prevent fraud or abuse.

10. Your rights

Under the General Data Protection Regulation (GDPR) you have the right to:

• ask which personal data we hold about you and receive a copy (access);
• have incorrect data corrected (rectification);
• have your data deleted (erasure);
• have the use of your data restricted (restriction);
• object to our use of your data based on legitimate interests (objection);
• receive the data you gave us in a common, machine-readable format (data portability);
• withdraw your consent at any time, for example for reminders or cookies, without affecting earlier use.

To use these rights, email info@harvesttycoon.com from the email address linked to your account, or include enough information for us to find your account. We may ask for more information to confirm that the request comes from you. We answer within one month; if a request is complex or we receive many, this can be extended by two more months, and we will tell you if that happens. Requests are free of charge, but if a request is clearly unfounded or excessive, we may charge a reasonable fee or refuse it, as the GDPR allows.

Some things you can do yourself at any time in the game under Settings: change your player name, switch reminders on or off, and sign out.

If you are unhappy with how we handle your data, please contact us first. You also have the right to lodge a complaint with a supervisory authority; in the Netherlands this is the Autoriteit Persoonsgegevens.

11. Deleting your account

You can ask us to delete your account and the personal data linked to it at any time. How to do this, and what happens next, is explained on our account deletion page. Deleting your account permanently removes your farm, progress, coins, diamonds and purchased items; they cannot be restored.

12. Children

Harvest Tycoon is intended for players aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has created an account, contact us and we will delete that account.

13. Security

We take appropriate technical and organisational measures to protect your data, such as encrypted connections, hashed passwords and access rules that limit what each player can see and change. No system is completely secure, so we cannot guarantee that data will never be lost, misused or changed. If a security incident is likely to put your rights at risk, we will act as the law requires.

14. Changes to this policy

We may update this policy, for example when the game or the law changes. The date at the top shows when it was last changed. If a change significantly affects how we use your personal data, we will let you know in the game or by email.

15. Contact

Questions about this policy or your data? Email info@harvesttycoon.com or write to Millstone, Acacialaan 18, 2282 AX Rijswijk, the Netherlands.