Privacy Policy

1. Who we are

Harvest Tycoon (the website harvesttycoon.com, the game, the installable web app, the Harvest Tycoon app for Android on Google Play and the Harvest Tycoon app for iPhone on the App Store) is operated by:

Millstone
Acacialaan 18, 2282 AX Rijswijk, the Netherlands
Chamber of Commerce (KvK) number: 89795857
Email: info@harvesttycoon.com

Millstone is the controller for the personal data described in this policy. In this policy, “we”, “us” and “our” mean Millstone, and “you” means anyone who visits the website or plays the game.

2. What we collect

Your account

• Your email address and password. Your password is stored in hashed form by our sign-in provider; we cannot read it.
• Your player name (chosen by you, or picked for you at random) and the avatar you choose.
• When your account was created, whether you confirmed your email address, and when you last signed in.
• Technical sign-in data kept by our sign-in provider for security, such as your IP address, browser type and session times.

Your game

• Your farm and progress: fields, crops, buildings, inventory, coins, diamonds, experience points, level, quests, achievements and statistics.
• A record of recent game actions with their times, so that the server can check them and repair problems.
• When you were last active, used to show whether you are online.
• Where and on what you last opened the game: your IP address, your browser and device type, the country of your device’s time zone and the language you play in. We use this to keep the game fair and secure (for example to spot one person playing with several accounts) and to see where our players come from and which languages they play in. Only your latest visit is kept: each new visit replaces it.
• When the game does not finish loading, its 3D view stops, or it closes while starting: a short technical report, sent with your next visit, of how far it got, how long it took, which game files did not arrive, your browser and device type, the name of your device's graphics chip and the graphics setting the game used, and whether you were online. It is not linked to your account, and we delete it after 90 days.
• Farm families: the families you join or create, your role, your contributions, invitations, and the help, gifts and requests you exchange with family members.
• Events: whether you took part, your progress, your ranking and your rewards.
• The chat: the messages you send (in the global chat, your family chat or a private chat), with your player name, avatar and the time; which chats you have read; the farmers you block; reports you make about a message; and your chat settings. If a moderator mutes or bans you from the chat, we keep that decision and its reason.
• Feedback, bug reports and feature requests you send with the Feedback button: your message, whether it is feedback, a bug or a feature request, and with it your player name, level, device (your browser's user agent), game language and the time. Our team and the moderators read them.
• Gifts or corrections we add to your account ourselves, for example after a support request.

Purchases

When you buy diamonds, a pack, a special offer or a season pass such as the Halloween Pass on our website, you pay on a checkout page run by Stripe. Stripe collects your payment details and any information it needs for the payment (such as your email address) under its own privacy policy. We receive and keep: what you bought, the price and currency, the payment status, the dates, and Stripe’s reference numbers for the checkout and the payment, linked to your account. We do not receive your full card number.

In our Android app (version 1.1 and later) you pay through Google Play instead. Google collects your payment details under its own privacy policy and is the seller of record for that purchase. We receive and keep: what you bought, the payment status, the dates, and Google’s references for the purchase (the order number and the purchase token), linked to your account. We check every purchase with Google before your farm gets it. When Google refunds a purchase (for example when you ask Google for a refund), Google tells us, and we take back what the purchase gave as far as your farm still has it. See The Android app.

In our iPhone app (version 1.1 and later) you pay through the App Store instead. Apple collects your payment details under its own privacy policy and is the seller of that purchase. We receive and keep: what you bought, the payment status, the dates, and Apple’s references for the purchase (the transaction ID and the original transaction ID), linked to your account. We check every purchase with Apple before your farm gets it. When Apple refunds a purchase (for example when you ask Apple for a refund), Apple tells us, and we take back what the purchase gave as far as your farm still has it. See The iPhone app.

On Kongregate you pay with Kreds through Kongregate instead; see Playing on Kongregate.

Reminders (only with your permission)

• Push notifications: if you allow them, we store the push address your browser gives us (a web address and encryption keys), your browser or device type, and whether delivery worked. In the Android app and the iPhone app push notifications go through OneSignal instead, and we only keep whether you turned them on and, if they could not be delivered, since when; see The Android app and The iPhone app.
• Daily email summary: if you switch it on, we send it to your account email address.
• News and offers by email: only if you switch on News & offers by email in Settings, or tick the box for it when you confirm your email address. Both start off. We keep whether you said yes and when you last changed it.
• Your reminder choices, your time zone and your preferred hour, and when we last sent you a reminder.

Push notifications only arrive after you allow them on your device. Once allowed, the reminders for private messages and mentions, your daily gift and crops & goods ready are on; email reminders and news and offers by email are off until you switch them on. The daily gift reminder also looks at when you last played: after 3 and 6 days away it tells you a comeback chest is waiting. You can change each of them at any time in the game under Settings.

When you contact us

If you write to us with our support form or by email, we keep your message, your email address and our reply for as long as we need them to help you.

Website visits

When you visit the website, our hosting and database providers process technical data such as your IP address, browser type and the pages or services requested, in order to deliver them and keep them secure. Google Analytics, the Meta Pixel and the TikTok Pixel also receive data when you visit; see section 8.

How you found us

When your farm is created, we record once how you found Harvest Tycoon: the campaign tag in the link you followed (such as src, utm_source, utm_medium, utm_campaign and utm_content), the name of the website that linked to us (only the domain, such as reddit.com, never the full address), whether the link carried a click ID from Facebook or Instagram, TikTok or Google, as their ads and some of their posts add (only yes or no, never the click ID itself), whether you came over from the Facebook, Instagram, Threads or TikTok app, the page you arrived on, your game language and your device type. Nothing for this is stored on your device: the page keeps it in memory until your account is made, and if you sign in with Google, Facebook, Apple or Discord or confirm your email, it goes along in the address of the page you come back to. If you sign up with an email address, it is also saved with your account right away, so it still counts if you confirm your email on another device. Only our team sees it, as totals per link, to learn which places bring farmers who enjoy the game.

Playing on CrazyGames

You can also play Harvest Tycoon on CrazyGames (crazygames.com). There you never sign up with us: no email address and no password.

• Logged in with CrazyGames: CrazyGames gives the game a signed token with your CrazyGames user ID and username (and a link to your CrazyGames profile picture, which we do not use). Our server checks the token and keeps the user ID with your farm, so you find the same farm wherever you log in to CrazyGames. Your username, made to fit our name rules, becomes your farmer name (a name you chose yourself as a guest stays); you can change it like any farmer name. We do not receive your CrazyGames password or email address.
• As a guest: if you are not logged in, we make a guest account for your farm, without a name, email address or any other details from you. The way back to it is kept in your browser (see section 8), so clearing your browser’s storage loses it. When you log in with CrazyGames later, the guest farm becomes the farm of your CrazyGames account.
• Everything else is as for any farm: your game data (above), that your farm came from CrazyGames (How you found us), and what other players can see (section 5). The chat is only open to players logged in with CrazyGames, and only when CrazyGames allows chat. To limit how many new guest farms one network can start, our server keeps a scrambled form (a keyed hash) of your IP address for at most two hours, never the address itself.
• No trackers from us: on CrazyGames we load no Google Analytics, Meta Pixel, TikTok Pixel or other trackers, show no ads of our own, set no cookies and send no emails or push notifications. CrazyGames runs its own website and software under its own privacy policy and is responsible for what it collects.
• Deleting your farm: email info@harvesttycoon.com with your farmer name (and your CrazyGames username if you logged in), and we delete your farm and the data linked to it.

Playing on Kongregate

You can also play Harvest Tycoon on Kongregate (kongregate.com). There you never sign up with us: no email address and no password. Only players signed in to Kongregate get a farm; a guest sees a page that asks to register or sign in with Kongregate.

• Signed in with Kongregate: Kongregate gives the game your Kongregate user ID, username and a sign-in token for this game. Our server checks the token with Kongregate and keeps the user ID with your farm, so you find the same farm wherever you sign in to Kongregate. So that a new start within the hour needs no new check, it also keeps a scrambled form (a keyed hash) of the token, never the token itself. Your username, made to fit our name rules, becomes your farmer name; you can change it like any farmer name. We do not receive your Kongregate password or email address.
• Everything else is as for any farm: your game data (above), that your farm came from Kongregate (How you found us), and what other players can see (section 5), the chat included. To limit how often one network can make us check sign-ins with Kongregate, our server keeps a scrambled form (a keyed hash) of your IP address for at most two hours, never the address itself.
• No trackers from us: on Kongregate we load no Google Analytics, Meta Pixel, TikTok Pixel or other trackers, show no ads of our own, set no cookies and send no emails or push notifications. Kongregate runs its own website and software, including the ads around the game, under its own privacy policy and is responsible for what it collects.
• Purchases with Kreds: on Kongregate you can buy diamonds, packs and passes with Kreds, Kongregate’s own currency. Kongregate sells the Kreds and runs the purchase window under its own privacy policy; we never see your payment details. We receive and keep: what you bought, its price in Kreds, the dates, your Kongregate user ID and Kongregate’s references for the purchase (the item’s ID and its usage record), linked to your account. We check every purchase with Kongregate before your farm gets it.
• Deleting your farm: email info@harvesttycoon.com with your farmer name and your Kongregate username, and we delete your farm and the data linked to it.

Playing on Discord

You can also play Harvest Tycoon on Discord, as an Activity. There you never sign up with us: no email address and no password. The game asks Discord whether it may know who you are; only players who allow that get a farm, and a player who says no sees a button to allow it later. The first time, you choose: a new farm for your Discord account, or the farm you already have on harvesttycoon.com.

• Signed in with Discord: when you allow it (Discord’s identify permission), Discord gives the game a one-time code. Our server exchanges it with Discord for an access token and uses that token once, to ask Discord who you are. Discord answers with your Discord user ID, username and language (and your display name and avatar, which we do not use). Our server keeps only the user ID with your farm, so you find the same farm wherever you open the game in Discord, and hands your language to the game so it opens in it. The access token is used once and never stored. We do not receive your Discord password or email address.
• A farmer name of our own: a new farm on Discord gets a farmer name picked at random; you can change it like any farmer name. Your Discord username, display name and avatar are not kept with your farm and never shown to other players.
• Your farm from harvesttycoon.com: you can play the farm you already have on our website in Discord instead. Discord then opens a one-time link to our website; you sign in there as usual and confirm with Link. Before linking, our website asks Discord to confirm that you are the same Discord account that asked (Discord’s identify permission): Discord sends you back with a one-time code, our server exchanges it for an access token, uses that token once to read your Discord user ID and links only if it matches; the token is not stored. Only then does our server keep your Discord user ID with that farm, so Discord opens it from then on; your account on our website stays as it is. So that the confirmation can show which Discord account asks, our server keeps your Discord username with the link ticket, also when you then choose a new farm. A ticket works once and for at most 10 minutes; we store only a scrambled form (a hash) of it, the username is erased within 15 minutes after the ticket is used or runs out, and the ticket with your Discord user ID one day after it runs out. On our website, Settings, Privacy, Unlink Discord ends the link at any time: Discord no longer opens that farm, and the farm is signed out on your other devices. When you tap Link, our server keeps with the ticket a scrambled form (a hash) of a one-time check value that goes to Discord and back, and which account on our website tapped Link, so that Discord’s answer counts only for that account, also when Discord opens it in another browser tab, once and for at most 10 minutes; both are erased as soon as the farm is linked, and otherwise within 15 minutes after the ticket is used or runs out. While you sign in, our website remembers the link in that browser tab for at most 10 minutes (harvest-tycoon:open, section 8).
• Replacing a farm made on Discord: if you play a farm that was made on Discord and choose Play your harvesttycoon.com farm here in Settings, that Discord farm and the data linked to it are deleted as soon as you confirm on our website, and Discord opens your website farm instead. Nothing is deleted if you do not confirm.
• Everything else is as for any farm: your game data (above), that your farm came from Discord (How you found us), and what other players can see (section 5), the chat included. Inside Discord the game reaches our website and servers through Discord’s own servers (discordsays.com), as every Activity does, so Discord handles that connection.
• No trackers from us: on Discord we load no Google Analytics, Meta Pixel, TikTok Pixel or other trackers, show no ads, sell nothing, set no cookies and send no emails or push notifications. Discord runs its own app and website under its own privacy policy and is responsible for what it collects. Signing in to link your farm happens on our website, outside Discord, where your cookie choice for our website applies (section 8).
• Deleting your farm: email info@harvesttycoon.com with your farmer name (we do not keep your Discord username, so the farmer name is how we find your farm), and we delete your farm and the data linked to it. A farm from harvesttycoon.com that you play on Discord you can also delete yourself on our website, under Settings, Privacy; that ends its link with your Discord account too. You can also remove Harvest Tycoon’s access in Discord under Authorized Apps in your settings; that stops new sign-ins but does not delete your farm.

The Android app

Harvest Tycoon is also available as an app for Android on Google Play. The app shows the same game as our website, inside the app. You sign in with your email address and password; the same account works on the website, so your farm is the same on your phone and your computer.

• Your data in the app: we collect the data described above for your account and your game. The only addition is what the app's push notifications need (below). The app does not ask for or use your location, contacts, camera, microphone, photos or files. It uses your device's advertising ID only for the Meta SDK and the TikTok SDK, and only if you accept cookies (below).
• Purchases through Google Play: from version 1.1 the app sells the same packs as our website, paid through Google Play (see Purchases); earlier versions sell nothing. Diamonds you earn in the game can be spent as usual, and what you bought on our website stays with your account, and the other way round.
• Signing in: only with your email address and password. Signing in with Google or Facebook is not available in the app.
• Push notifications through OneSignal: the app contains software from OneSignal, which delivers the app's push notifications on our behalf. Until you turn notifications on in the game (for example Turn on notifications in Settings, Reminders), OneSignal receives nothing about your account or your game: when the app starts, it only downloads its notification settings from OneSignal, a request that shows OneSignal your IP address and a random number for this installation of the app, and it gets a push token for your phone from Google's push service (Firebase Cloud Messaging), which stays on your phone. From then on, to deliver them, OneSignal receives your player ID, a push token for your phone and device data, namely the device type and model, Android version, language, time zone, country (worked out from your IP address), mobile carrier, app version, and when, how often and how long you use the app. Your player ID lets notifications reach every phone you play on; when you sign out in the app, that phone is no longer linked to your player ID. Notifications only arrive once you have also allowed them on your phone. They are the same reminders as on the website, with the same switches. Turning them off in Settings, or for the app in your phone's Android settings, stops them. We keep only whether you turned them on and, if OneSignal could not deliver them to any of your phones, since when, so the game can link your phone again. When you delete your account, we also delete your data at OneSignal that is linked to your player ID. The daily email summary works as on the website.
• Cookies: the app asks the same cookie question as the website (see section 8). It shows no ads.
• Meta SDK, only if you accept cookies: from version 1.2 the app contains software from Meta (the Meta SDK) to measure which of our ads bring players to the app. It does not start until you choose Accept in the cookie question. From then on it sends Meta that the app was installed, when you open and close it and how long you use it, when you reach level 5 and, if you buy something, the purchase made through Google Play. With these go your device's advertising ID, a random ID that Meta's software keeps on your phone, Google Play's note of where the installation came from (for example which ad), your IP address and device data (such as the device model, Android version, language, time zone and mobile carrier). Meta uses this to measure our ads and to show them to people who may like the game. Until you choose, and from the moment you choose Decline (also when you change your choice later in Settings), the Meta SDK sends nothing, and what it had not sent yet is deleted from your phone. Like on the website, your choice counts for 12 months; then the app asks again. If you chose Accept in the app before version 1.2, the app asks you once more. You can also reset or delete your advertising ID in your phone's Android settings. Legal basis: your consent (Article 6(1)(a) GDPR).
• TikTok SDK, only if you accept cookies: from version 1.5 the app also contains software from TikTok (the TikTok Business SDK) to measure which of our TikTok ads bring players to the app. It starts and stops together with the Meta SDK, with the same cookie choice. From then on it sends TikTok that the app was installed, when you open it and when you reach level 5. With these go your device's advertising ID, Google Play's note of where the installation came from (for example which ad), your IP address and device data (such as the device model, Android version and language). It receives no purchases and never your name, email address or phone number. TikTok uses this to measure our ads and to show them to people who may like the game. Until you choose, and from the moment you choose Decline, the TikTok SDK sends nothing, and what it kept is deleted from your phone. Legal basis: your consent (Article 6(1)(a) GDPR).
• Google Analytics for Firebase, only if you accept cookies: from version 1.7 the app also contains software from Google (Google Analytics for Firebase) to measure which of our Google ads bring players to the app. It starts and stops together with the Meta SDK, with the same cookie choice. From then on it sends Google that the app was installed, when you open it and when you reach level 5. With these go your device's advertising ID, a random ID that Google's software keeps on your phone, Google Play's note of where the installation came from (for example which ad), your IP address and device data (such as the device model, Android version and language). It receives no purchases and never your name, email address or phone number. Google uses this to measure our ads. Until you choose, and from the moment you choose Decline, it sends nothing, and what it kept is deleted from your phone. Legal basis: your consent (Article 6(1)(a) GDPR).
• Google Play: Google handles downloading and updating the app under its own privacy policy. Google may give us statistics about the app, such as the number of installs and crash reports, that do not tell us who you are.
• Deleting your account works the same as on the website: in the game under Settings, Privacy, Delete account; see section 11.

The iPhone app

Harvest Tycoon is also available as an app for iPhone on the Apple App Store. It works like the Android app: the same game as our website, inside the app, with the same account, so your farm is the same on your iPhone, your other devices and your computer.

• Your data in the app: we collect the data described above for your account and your game, and what the app's push notifications need (below). The app does not ask for or use your location, contacts, camera, microphone, photos or files, and it does not use your device's advertising identifier.
• No Tag Manager, no cookies, no ad tracking: the app loads no Google Tag Manager, Google Analytics, Meta Pixel or TikTok Pixel, sets no cookies for statistics or ads and shows no cookie banner. It does not track you across other companies' apps or websites, and it shows no ads. It only keeps the storage the game needs (see section 8).
• Purchases through the App Store: from version 1.1 the app sells diamonds, packs and passes, paid through the App Store; Apple is the seller and handles the payment (see Purchases). Diamonds you earn in the game can be spent as usual, and what you bought on our website stays with your account, and the other way round.
• Signing in: with your email address and password and, from version 1.3 on iOS 17.4 or later, also with Google, Facebook, Apple or Discord (see section 3). Earlier versions, and version 1.3 on older iOS versions, offer only your email address and password.
• Push notifications through OneSignal and Apple: the app's push notifications are delivered by OneSignal on our behalf, through Apple Push Notification service, in the same way as in the Android app: OneSignal receives nothing about your account or your game until you turn notifications on in the game; from then on it receives your player ID, a push token for your iPhone and device data (such as the device model, iOS version, language, time zone, country and app version). Notifications only arrive once you have also allowed them on your iPhone. Turning them off in Settings, or for the app in your iPhone's settings, stops them; signing out in the app ends the link between that iPhone and your player ID.
• Apple: Apple handles downloading and updating the app under its own privacy policy. Apple may give us statistics about the app, such as the number of installs and crash reports, that do not tell us who you are.
• Deleting your account works the same as on the website: in the game under Settings, Privacy, Delete account; see section 11.

3. Signing in with Google, Facebook, Apple or Discord

You may be able to sign in with a Google, Facebook, Apple or Discord account instead of an email address and password. This is optional; you can always use your email address.

This is not available in the Android app, in the iPhone app before version 1.3 or on iOS older than 17.4; there you sign in with your email address and password. In the iPhone app from version 1.3, Apple shows its own Sign in with Apple screen, and Google, Facebook and Discord open in your iPhone’s secure sign-in window, not inside the app.

• If you choose Google, Facebook or Discord, that service asks you to agree to share your name (on Discord your username), email address and profile picture with Harvest Tycoon, together with a unique identifier for your account at that service.
• If you choose Apple, Apple asks you to agree to share your name (only the first time, and you can change it on Apple’s screen) and an email address with Harvest Tycoon, together with a unique identifier for your Apple Account. Apple shares no profile picture. You choose which address: your own, or a private address from Apple’s Hide My Email that forwards our emails to you.
• We use the email address and the identifier to create your account and to sign you in. Our sign-in provider stores the name and profile picture with your sign-in details; the game does not show them. Other players see only the player name and avatar you choose in the game.
• If you choose Apple, we also keep the token Apple gives us for your sign-in (a refresh token; nothing else from Apple), only so that we can ask Apple to remove Harvest Tycoon from Sign in with Apple in your Apple Account when you delete your Harvest Tycoon account. It is deleted together with your account.
• We do not receive your Google, Facebook, Apple or Discord password, and we do not get access to your contacts, friends, servers, messages or posts. We never post anything on your behalf.
• If the email address matches an existing Harvest Tycoon account, you may be signed in to that same account.

Google, Meta, Apple and Discord process your data under their own privacy policies. You can remove Harvest Tycoon’s access at any time in your Google account, your Facebook settings, your Apple Account (Sign in with Apple) or Discord’s Authorized Apps. That stops future sign-ins through that service but does not delete your Harvest Tycoon account; see section 11 for that.

4. How we use your data, and on what legal basis

• To provide your account and the game: signing you in, saving your farm, the leaderboards, farm families, events and support. Legal basis: performance of our agreement with you (Article 6(1)(b) GDPR).
• To process purchases and deliver what you bought. Legal basis: performance of our agreement with you.
• To send account emails, such as the confirmation link and password reset. Legal basis: performance of our agreement with you.
• To send reminders by push notification or email, only after you allow push notifications on your device or switch on email reminders. Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time in Settings or through the unsubscribe link in each email.
• To make push notifications possible in the Android app: once you turn them on in the game, registering your phone with OneSignal and linking it to your player ID (see The Android app), so that they reach every phone you play on; before that, only downloading the app's notification settings from OneSignal and a push token from Google when the app starts. In the iPhone app the same, once you turn them on in the game (see The iPhone app). Legal basis: our legitimate interest in notifications that work (Article 6(1)(f) GDPR). You can object at any time: info@harvesttycoon.com.
• To send news and offers by email (new features, events and offers in Harvest Tycoon), only after you have said yes to that separately. Legal basis: your consent (Article 6(1)(a) GDPR and Article 11.7 of the Dutch Telecommunications Act). You can withdraw it at any time in Settings or through the unsubscribe link in every email; withdrawing does not affect emails we sent before.
• To keep the game fair, secure and working: preventing cheating, fraud and abuse, finding and fixing errors, and understanding how the game is used from our own game records. Legal basis: our legitimate interests in a safe, fair and working game (Article 6(1)(f) GDPR).
• To understand how visitors find and use Harvest Tycoon, to measure our advertising and to show our ads to people who visited our website, with Google Analytics, Google Ads, the Meta Pixel and the TikTok Pixel, and in our Android app the Meta SDK and the TikTok SDK, only if you accept cookies. Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time under Cookie settings.
• To learn which links, websites and ads bring new farmers, from our own record of how you found us (see section 2; no cookies, nothing stored on your device). Legal basis: our legitimate interest in spending our time and advertising budget well (Article 6(1)(f) GDPR). You can object at any time: info@harvesttycoon.com.
• To show our own players our ads on Facebook, Instagram and TikTok (Meta Custom Audiences and TikTok Custom Audiences): we may upload the email address of your account to Meta and TikTok, to Meta together with the total you spent in the game if you made a purchase. Before anything leaves our database it is turned into a scrambled code (hashed with SHA-256), so Meta and TikTok never receive your address in readable form. They only use the codes to match them with their own accounts (Facebook and Instagram, or TikTok), to show our ads to those people and to find people with similar interests, and delete codes they cannot match. We share no other account or game data. Legal basis: our legitimate interest in telling our own players about Harvest Tycoon (Article 6(1)(f) GDPR). You can object at any time by writing to info@harvesttycoon.com; we then leave you out of every later upload and remove you from the audience.
• To keep financial records and meet other legal obligations. Legal basis: legal obligation (Article 6(1)(c) GDPR).
• To establish, exercise or defend legal claims. Legal basis: our legitimate interests.

We do not use your data for automated decisions that have legal or similarly significant effects on you.

5. What other players can see

Harvest Tycoon is a multiplayer game. Other signed-in players can see your player name, avatar, level, your game statistics on the leaderboards, whether you have VIP, and whether you are online. Members of your farm family also see your contributions and the help, gifts and requests you exchange. Event rankings show the player name, avatar and level of the top players. Your email address is never shown to other players.

The chat. Messages in the global chat can be read by every signed-in player, family messages by the members of that family, and private messages only by the two farmers in that chat. Moderators (players we trust to keep the chat friendly) and we can read a message that someone reports, and can delete it or mute or ban its sender from the chat; a chat ban never affects your farm. When a farmer mentions you in the global or family chat (@ and your farmer name), the message keeps your player id and farmer name with it, so the name opens your profile, and it reaches you like a private message. You can block a farmer, and you can switch private messages off under Settings. Please do not share personal details such as your address or phone number in the chat.

Choose a player name that does not reveal more about you than you want to share. You can change it at any time under Settings.

Invite a friend. Your invite link contains a short code, not your email or account ID. If someone starts Harvest Tycoon with your link, you see their player name and level in your list of invited friends, and they see your player name. When they reach level 10 within 30 days, you both receive diamonds.

Share my farm. The picture is made on your device from your farm view. It shows your player name, level, family name and flag, and your invite link. It is not sent to us; you choose where to share it.

6. Who helps us

We use the following service providers. They process personal data on our behalf or, where stated, under their own privacy policies.

• Supabase: database, sign-in and server functions. Our project is hosted in the European Union (Frankfurt, Germany).
• Vercel: hosting of the website.
• Stripe: payments on our website. Stripe also processes payment data under its own privacy policy.
• Google Play: payments in our Android app. Google processes payment data under its own privacy policy.
• Resend: delivery of our emails.
• Push services of your browser or device maker (for example Apple, Google, Microsoft or Mozilla): delivery of push notifications, if you allow them. In the Android app, Google's push service (Firebase Cloud Messaging) gives your phone a push token when the app starts.
• OneSignal: delivery of push notifications in the Android app and the iPhone app, on our behalf. OneSignal receives nothing about your account or your game until you turn notifications on in the game (before that, the app only downloads its notification settings when it starts); from then on it receives your player ID, a push token and device data for your phone; see The Android app.
• Google: Google Tag Manager, Google Analytics, Google Ads (measuring our ads and showing them to people who visited our website) and, if you use it, Google sign-in.
• Google Play: distribution and updates of the Android app.
• Apple: distribution and updates of the iPhone app (the App Store), payments in the iPhone app (Apple processes payment data under its own privacy policy), Apple Ads (our ads in the App Store, which Apple measures itself; the app sends nothing for them), Apple Push Notification service, which delivers the iPhone app's push notifications, and, if you use it, Sign in with Apple.
• Meta: the Meta Pixel (also to show our ads to people who visited our website), the Meta SDK in our Android app, Custom Audiences for our ads on Facebook and Instagram (see section 4) and, if you use it, Facebook sign-in.
• TikTok: the TikTok Pixel (also to show our ads to people who visited our website), the TikTok SDK in our Android app and Custom Audiences for our ads on TikTok (see section 4).

We may also share personal data when the law requires it, to protect our rights, the safety of players or the security of the game, or as part of a merger, sale or transfer of the game or our business. In that last case this policy will continue to apply to your data unless you are told otherwise.

We do not sell your personal data.

7. Data outside the EU

Our database is in the European Union. Some of the providers above, including Vercel, Stripe, Resend, OneSignal, Google, Meta and TikTok, may process data outside the European Economic Area, for example in the United States. Where that happens, we rely on the transfer mechanisms those providers offer, such as the EU–U.S. Data Privacy Framework or the European Commission’s standard contractual clauses.

8. Cookies and local storage

Storage the game needs

The game itself does not set cookies. It stores a few small items in your browser’s local storage so that it works:

The website also installs a small service worker so the game can be installed as an app and can show push notifications. It keeps one small page to show when there is no internet connection and, for the number on the app icon, how many unread chat messages you have. It does not store copies of the game or your data.

Analytics and advertising

Only if you choose Accept in the cookie banner, our website loads Google Tag Manager, which runs Google Analytics, Google Ads, the Meta Pixel and the TikTok Pixel. We use them to understand how visitors find and use Harvest Tycoon, to measure our advertising and to show our ads on Google, Facebook, Instagram and TikTok to people who visited our website. If you decline, or make no choice, these tools are not loaded.

• The events our game sends to these tools contain only general facts, such as the type of device, which step of sign-up was reached, your level or which diamond pack was bought. They never include your email address, player name or account ID.
• Google, Meta and TikTok do receive your IP address and information about your browser and device, and they set cookies to recognise your browser, such as _ga and _ga_… (Google Analytics, by default up to two years), _gcl_au (Google Ads, by default up to 90 days), _fbp (Meta Pixel, by default up to 90 days) and _ttp (TikTok Pixel, by default up to 13 months). Google, Meta and TikTok process this data under their own privacy policies, and Google, Meta and TikTok may use it for their own purposes, such as advertising.

You can change your choice at any time with Cookie settings at the bottom of the home page or under Privacy in the game’s Settings. When you decline, we remove the Google Analytics, Google Ads, Meta Pixel and TikTok Pixel cookies that were set on our own domain, and if the tools were already running, the page reloads so they stop. You can also block or delete cookies in your browser settings; the game works without them. You can also use Google’s Google Analytics opt-out browser add-on and manage ads from Google in My Ad Center, ads from Meta in your Facebook ad preferences and ads from TikTok in the ad settings of your TikTok account.

The privacy policy and account deletion pages do not load these tools.

9. How long we keep data

• Account and game data: for as long as your account exists. We may delete accounts that have not been used for a long time.
• When you delete your account in the game: we delete your personal data or make it anonymous at once, except the data below that we must or may keep. If you ask us to delete it instead, we do so within one month.
• Purchase records: for as long as Dutch tax and accounting rules require, generally seven years.
• Chat messages: 30 days, then they are deleted automatically. Notifications in the chat: at most 60 days. Reports that have been handled: 90 days.
• Feedback, bug reports and feature requests: one year, then they are deleted automatically.
• Reports of a game that did not finish loading: 90 days, then they are deleted. They are not linked to your account.
• Push notification addresses: until you switch push notifications off or sign out on that device, or until the push service tells us the address no longer works.
• Notifications in the Android app and the iPhone app: whether you turned them on, and since when they could not be delivered (until they can again), for as long as your account exists. OneSignal keeps a phone's push token and device data for as long as we use OneSignal, unless we delete them earlier. Signing out in the app ends the link between that phone and your player ID; when you delete your account, we also delete the data at OneSignal that is linked to your player ID.
• Daily email summary: until you switch it off or unsubscribe.
• Emails with us: for as long as needed to handle your question, and afterwards only if we need them for legal reasons.
• How you found us: for as long as your account exists.
• Playing on CrazyGames: the link between your CrazyGames user ID and your farm, for as long as your account exists; the scrambled IP address of a new guest farm, at most two hours.
• Playing on Kongregate: the link between your Kongregate user ID and your farm, for as long as your account exists; the scrambled sign-in token, until the next check replaces it; the scrambled IP address of a sign-in check, at most two hours.
• Playing on Discord: the link between your Discord user ID and your farm, for as long as your account exists. A link ticket: your Discord username, and once you tap Link which account on our website tapped it, until the ticket is used or runs out (at most 10 minutes) and erased within 15 minutes after that; the ticket itself, with your Discord user ID, until one day after it runs out. Discord’s access token is not kept at all.
• Technical logs: for a limited period, according to the settings of our hosting and database providers.
• Analytics data: according to the retention settings of Google Analytics, Meta and TikTok.
• Backups: deleted data can remain in backups for a limited time until those backups are replaced.

We may keep data for longer where that is needed to establish, exercise or defend legal claims, or to prevent fraud or abuse.

10. Your rights

Under the General Data Protection Regulation (GDPR) you have the right to:

• ask which personal data we hold about you and receive a copy (access);
• have incorrect data corrected (rectification);
• have your data deleted (erasure);
• have the use of your data restricted (restriction);
• object to our use of your data based on legitimate interests (objection);
• receive the data you gave us in a common, machine-readable format (data portability);
• withdraw your consent at any time, for example for reminders or cookies, without affecting earlier use.

To use these rights, write to us with our support form or email info@harvesttycoon.com from the email address linked to your account, or include enough information for us to find your account. We may ask for more information to confirm that the request comes from you. We answer within one month; if a request is complex or we receive many, this can be extended by two more months, and we will tell you if that happens. Requests are free of charge, but if a request is clearly unfounded or excessive, we may charge a reasonable fee or refuse it, as the GDPR allows.

Some things you can do yourself at any time in the game under Settings: change your player name, switch reminders on or off, sign out, and delete your account.

If you are unhappy with how we handle your data, please contact us first. You also have the right to lodge a complaint with a supervisory authority; in the Netherlands this is the Autoriteit Persoonsgegevens.

11. Deleting your account

You can delete your account and the personal data linked to it yourself at any time, in the game under Settings, Privacy, Delete account, on the website, in the Android app and in the iPhone app. After a warning you type your farmer name to confirm, and your account is deleted at once. If you can no longer sign in, ask us through our support form from the email address linked to your account. If you signed in with Apple, we also ask Apple to remove Harvest Tycoon from Sign in with Apple in your Apple Account. What is deleted and what is kept is explained on our account deletion page.

Deleting your account permanently removes your farm and all your progress, coins, diamonds, VIP, medals and purchased items, your place in your farm family, your chat and private messages and your invites; they cannot be restored, and purchases are not refunded. A partner’s earnings that have not been paid out yet are lost too. We keep purchase records, in our records no longer linked to you (Stripe, Google and Apple keep their own payment records), for as long as Dutch tax and accounting rules require, generally seven years.

12. Children

Harvest Tycoon is intended for players aged 16 and over. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has created an account, contact us and we will delete that account.

13. Security

We take appropriate technical and organisational measures to protect your data, such as encrypted connections, hashed passwords and access rules that limit what each player can see and change. No system is completely secure, so we cannot guarantee that data will never be lost, misused or changed. If a security incident is likely to put your rights at risk, we will act as the law requires.

14. Changes to this policy

We may update this policy, for example when the game or the law changes. The date at the top shows when it was last changed. If a change significantly affects how we use your personal data, we will let you know in the game or by email.

15. Contact

Questions about this policy or your data? Use our support form, email info@harvesttycoon.com or write to Millstone, Acacialaan 18, 2282 AX Rijswijk, the Netherlands.

Apple and the Apple logo are trademarks of Apple Inc., registered in the U.S. and other countries and regions. App Store is a service mark of Apple Inc. Google Play and the Google Play logo are trademarks of Google LLC.