Privacy Policy

Who We Are

TinyHarvest ("the App") is developed by Simon Grimm, Germany ("we", "us"). We are the controller responsible for your personal data under the EU General Data Protection Regulation (GDPR). You can reach us at simon@galaxies.dev.

This policy explains what data the App collects, why, who we share it with, and what rights you have. We do not sell your personal data, and we do not show ads.

Information We Collect

Account Data

You can play without an account; your progress then stays on your device. If you sign in to save your farm, we receive from Apple, Google, or your email login:

• Your email address (with Apple, this may be a private relay address)
• Your name, which we use to suggest a username (you can change it)
• A unique user ID

Game and Profile Data

• Your game progress: farm, inventory, levels, coins, diamonds, achievements, and purchases unlocked
• Your username, friend code, co-op membership, and leaderboard scores, which other players can see
• A profile picture, if you choose to upload one from your camera or photo library

Social Content

• Messages you send in global and co-op chat, and reactions
• Friend connections, marketplace listings, wanted requests, and gifts
• Reports you send and moderation actions taken on your account

Device and Technical Data

• Device model, operating system, and app version
• A device identifier created by the App and your device's vendor identifier (Android ID on Android), used to prevent abuse and enforce bans
• A push notification token, if you allow notifications
• IP address, which is processed when your device connects to our servers and our service providers

Usage and Diagnostics

• Gameplay events, such as levels reached, features used, and session length
• Crash reports, error logs, and performance data

These are linked to your user ID and username so we can help you when something goes wrong. We do not record your screen.

Purchases

Payments are processed by Apple or Google. We never see your payment details. We receive a record of what you bought, when, and your subscription status.

This Website

tinyharvest.app uses PostHog for cookieless visitor statistics: which pages are viewed, where visitors came from, their approximate country, and clicks on the store buttons. It sets no cookies and stores nothing on your device, and we cannot identify you from it.

What We Do Not Collect

We do not collect your precise location or contacts, we do not use the advertising identifier (IDFA/AAID), and we do not track you across other companies' apps or websites.

How We Use Your Information

• To run the game: saving your farm, syncing across devices, social features, events, and delivering purchases. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• To keep the community safe: moderating chat, handling reports, and preventing cheating, fraud, and ban evasion. Legal basis: our legitimate interests (Art. 6(1)(f) GDPR).
• To fix bugs and improve the game: crash reports, diagnostics, and gameplay analytics. Legal basis: our legitimate interests (Art. 6(1)(f) GDPR).
• To send notifications: for example when crops are ready or friends need help, if you allow them. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in your device settings.
• To answer your support requests and meet legal obligations, such as tax records for purchases (Art. 6(1)(c) GDPR).

Service Providers

We use the following providers to run the App. They process data on our behalf and only as necessary to provide their service to us.

• Amazon Web Services (USA): hosting for our game database, cloud saves, and profile pictures
• Railway (USA): hosting for our game server
• RevenueCat (USA): managing in-app purchases and subscriptions
• PostHog (EU): gameplay analytics and website statistics
• Sentry (USA): crash reporting and error diagnostics
• Expo (USA): app updates, performance metrics, and sending push notifications
• Google Firebase Cloud Messaging (USA): delivering push notifications on Android
• Postmark (USA): sending email sign-in codes
• Apple and Google: sign-in, app distribution, and payments, under their own privacy policies

If you downloaded the App through an Apple Search Ads campaign, RevenueCat receives an attribution token from Apple that tells us which campaign led to the install. It does not identify you personally.

International Transfers

Some providers process data in the United States. We rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses, to protect your data.

What Other Players Can See

Your username, profile picture, level, friend code, co-op, farm (when visited), marketplace listings, leaderboard scores, and chat messages are visible to other players. Please do not share personal information in your username or in chat.

How Long We Keep Data

• Account and game data: as long as your account exists
• Analytics and diagnostics: deleted automatically by our providers, generally within 90 days
• Moderation records, including device identifiers of banned accounts: as long as needed to enforce bans
• Purchase records: as long as required by tax and accounting law (up to 10 years in Germany)

Deleting Your Account

To delete your account, use "Request Account Deletion" in the App's profile screen, or email us at simon@galaxies.dev from the address linked to your account. We will delete your account, game progress, and profile picture, and remove your personal data from our providers where applicable, within 30 days. Records we are legally required to keep are retained only for as long as the law requires.

Deleting the App from your device does not delete your account, and does not cancel an active subscription.

Children's Privacy

TinyHarvest is not directed at children under 13, or under the minimum age for consent in your country (up to 16 in some EU countries). If you are a parent or guardian and believe your child has given us personal information, please contact us and we will delete it.

Your Rights

Under the GDPR and similar laws, you have the right to:

• Access the personal data we hold about you and get a copy of it
• Correct inaccurate data
• Have your data deleted
• Restrict or object to processing based on our legitimate interests
• Receive your data in a portable format
• Withdraw consent at any time, without affecting earlier processing
• Complain to a data protection supervisory authority, for example the one in your country of residence

To exercise these rights, email us at simon@galaxies.dev.

This Website

Our websites (tinyindie.de, including these TinyHarvest pages) set no cookies. To see how they are used, we count visits with our own counter on our TinyIndie server in Germany, without third-party tools. For each page view it records the page, the referring page, campaign parameters in the link, your browser's time zone and language, screen width and device type, how long the page stayed visible and clicks on external links. Your IP address is only used, together with your browser's user agent and a random value that changes every day, to tell visits apart on the same day; the IP address itself is never stored. The data is not shared and is deleted after 400 days. Legal basis: our legitimate interest in understanding how our websites are used (Art. 6(1)(f) GDPR).

Data Security

Data is encrypted in transit, and access to our systems is restricted. No method of transmission or storage is completely secure, but we work to protect your information.

Changes to This Privacy Policy

We may update this policy when the App or the law changes. We will post the new version on this page and update the "Last updated" date, and tell you in the App about significant changes.

Contact Us

If you have any questions about this Privacy Policy or want to exercise your rights, contact us at:

Email: simon@galaxies.dev
Subject: Privacy Inquiry