The Needle in the Haystack 2 Privacy Policy

Last updated: 2026-11-11 · Terms of Use

1. Controller

The controller for data processing in the app The Needle in the Haystack 2 is BRUNIQO, Alessandro Brüning, Katharina-Bräckeler-Straße 4a, 41462 Neuss, Germany. Email: support@bruniqo.de. Further details are in the legal notice (Impressum).

This policy covers the iOS app The Needle in the Haystack 2 (German title: Nadel im Heuhaufen 2) and its game server. The website privacy policy applies to visits to this website.

It also covers the Android app „Nadel im Heuhaufen“ on Google Play. What differs on Android (Sign in with Google or Apple, purchases through Google Play, advertising ID for ads) is described in section 14.

2. Overview

You can play solo without Sign in with Apple; your save is stored on your device, but you need a connection to our game server to play. Shared yards, online account recovery, purchases of account credits and rewarded-video credit claims require the relevant online service. Local world money and online account credits are separate balances.

Unity LevelPlay mediates ads from the integrated ironSource Ads, Unity Ads and Liftoff Monetize (Vungle) networks. The in-app personalized advertising choice is separate from iOS tracking permission (section 6). There is no standalone third-party gameplay analytics service; advertising SDKs do process data for advertising analytics. We record crashes and errors in the app and the game server with the error reporting service Sentry so that we can fix them; for this the app also reports the start and end of each use (section 7). The app does not request GPS location or access contacts, camera or microphone. Only if you want to attach a screenshot to voluntary feedback does the system picker pass the image you explicitly select to the app; this does not request access to your entire photo library.

2.1 Voluntary feedback

You can report a bug or suggest an improvement through “Send feedback” in “Account & credits” or the online account area, including without signing in. Only when you tap “Send” does the app transmit the selected category, your description, app language, the app version, build, platform and operating system version shown before sending, and, if supplied, your optional reply email address and an image you selected to our game server. The server forwards the message by email to feedback@bruniqo.de, an address that leads to the support@bruniqo.de support mailbox. A reply email address is not required; without it we cannot reply to you this way. Screenshots are never captured automatically. Check selected images for private details and other people’s data before sending. This voluntary feedback is a separate data flow from the automatic Sentry crash and error reports in section 7.

To prevent repeated attempts from sending the same message more than once, the game server stores a random request ID with status and time for 24 hours. This technical dispatch table contains no description, email address or image. The 24 hours apply only to this technical dispatch receipt, not to the contents of the email received in the support mailbox.

3. Sign in with Apple

If you want to use an online account, you sign in with "Sign in with Apple". The app does not request your name or email address from Apple. Our server verifies the sign-in directly with Apple and redeems the one-time authorization code with Apple.

We do not store the user identifier supplied by Apple in plain text, only as an irreversible check value derived with a secret key (HMAC). This check value is mapped to a randomly generated internal account identifier. We also store the refresh token issued by Apple in encrypted form so that we can revoke the link to your Apple Account with Apple when you delete your account.

After sign-in the app receives a random session token, which is kept in the keychain on your device. On the server we store only a hash of it. A session is valid for at most 30 days; "Sign out" ends it immediately. If you sign in on another device, the previous session ends after you confirm.

4. Player profile and game progress

For your account we store your display name (by default "Spieler"), the appearance of your character, game values such as level and experience points, your personal credits, permanently acquired tools, and your current and recently visited yards.

Local solo saves remain on your device. For each online yard the server stores the game state, for example digging progress, built facilities and machines, the yard's money, research, equipment and the retention deadline. The game state is built from a log of game actions that records which player account performed which action.

While you play in a yard, the other members of that yard see your display name, your character's appearance, its position and activity in the game world, and quick-chat messages you send. This also applies to public crews with players you do not know. Quick-chat messages are preset phrases; free text, voice messages or images cannot be sent. The position is a coordinate in the virtual game world, not the location of your device.

Usage statistics for signed-in accounts. If your account is signed in, we record one day mark for every calendar day (UTC) on which it connected to our server, together with the platform (iOS or Android). For new accounts we also store the day of account creation and the platform. We use this only for aggregated figures, such as how many accounts are active and how many return after 1, 7 and 30 days. Times of day, game content, location and device details are not included. Day marks are deleted after at most 31 days, the creation day after 32 days, both immediately on account deletion or objection. Players without an account receive no day mark; the next paragraph describes the app's anonymous game statistics.

Anonymous game statistics of the app. So that we can improve the game in a targeted way and run the advertising that funds it economically, the app counts on your device, also if you play without an account, and sends aggregated day counters to our own game server about once a day or when it goes to the background. It counts how many sessions there were and how long they lasted (only in ranges such as “1 to 5 minutes”), play minutes, the four-hour block (UTC) in which a session started, how long loading took, the screen on which a session ended, how many days have passed since installation (in ranges) and whether the app was opened again after 1, 7 or 30 days, which first steps were reached once, which menus were opened and which game actions were taken (for example the kind of machine built, the research area, the end of a round with its duration range), steps in the shop (opened, purchase started, completed or cancelled, without the product), crew size in ranges, and technical details in ranges (device class by memory, frame time, memory warnings, restarts of the game view, major operating system version, app language, connection drops). For advertising the app counts, per format, placement and ad network, how often an ad was loaded, unavailable or shown, how long loading took (in ranges), the estimated revenue per ad reported by the ad SDK as a daily sum (the country only as a broad country group), how many ads appeared per session and whether a session ended shortly after a full-screen ad, as well as the distribution of the iOS tracking permission and the ad choice and whether ad-free is active or was bought. Each counter carries only the platform, app build, calendar day (UTC) and, where relevant, “guest” or “account”, but no device, installation, account or advertising ID, no exact time and no individual events. Each upload carries its own random number so that an upload repeated after a lost connection is not counted twice; it is new for every upload, names no device and is deleted after at most nine days. The server checks every value, discards unknown ones and stores only daily sums per platform and build. If you are signed in and have objected to the usage statistics (section 12), the app counts and sends none of this and discards what it has not yet sent; until the game server has confirmed your objection status after a start, everything stays on your device. Sending technically transmits your IP address; it is processed only briefly to prevent abuse (section 7).

Internal player profile. So that we can develop prices, offers, ad placements and game balance from actual courses of play, above all for purchases and advertising, we keep an internal player profile for every account on our own game server. It is separate from the game data of your account described above and is not shown in the game, not even to you. The profile consists of a history of events with the day and the time to the minute, and of figures calculated from it. The server records what it books or verifies itself: sign-ins, purchases of credit packs (pack, credits, list price and currency, store, and any first-purchase or offer bonus), refunds and reversals, every spending of credits with its kind (for example boosters, tools, talent points or permanent machines), price and your two balances (purchased credits and ad credits) before and after, other credit grants, rewarded videos (reserved, cancelled, confirmed by the ad network and credited), accepted and expired offers, rounds completed in the online yard with their outcome (needle found or yard reset) and the shares of straws that left the heap by hand, by machine or through mining, invalid bonus codes, and the days and time-of-day blocks in which you played online. When the profile is first created, the server adds the bookings that already exist for your account to the history once. In addition, the app sends a daily report for your account with fixed counters: offers shown and opened, ad impressions per format and placement, ads not shown because of the ad pacing, rewarded videos offered, the estimated ad revenue reported by the advertising SDK as a daily sum, minutes played (alone, in your own yard or in someone else's yard), the state of iOS tracking permission and of your ad choice, app language, a broad country group and the app build. The server also takes the round report that the app sends at the end of a round in the solo yard as daily counters (number of rounds and shares of straws by the same division). We mark these values as reported by the device; the server checks them against fixed lists and limits, discards unknown ones and never uses them for balances, purchases or credits. From all of this the server calculates figures such as revenue per player, the time until the first purchase and classifications, for example by purchase, ad and play behaviour, including a play style (mostly by hand, by machine or through mining). The profile is stored under a short code that the server derives from your account ID with a secret key (HMAC); it contains no account, transaction, installation or advertising IDs, no IP address, no precise location and no free text. If you play without an account and watch a rewarded video, your app receives a random guest identifier from the server, of which the server stores only a hash; for it the server keeps a guest profile in the same way, which becomes part of your account's profile when you sign in. Only we as the operator have access, through protected operator access; analyses showing individual profiles stay internal, and we pass the profile on neither to third parties nor to ad networks. If you have objected to the usage statistics (section 12), no profile is created.

5. Credit purchases through Apple

You buy credit packs with 50, 100, 500 or 1,000 credits through Apple's in-app purchase. Apple handles payment exclusively; we receive no payment or card data.

When you buy, the app passes Apple a random purchase identifier linked to your game account so that the purchase can be credited to your account. Our server verifies the transaction signed by Apple and credits the credits exactly once. For each purchase we store the transaction number, the product, the credits added and any refund status. Apple notifies our server of refunds; refunded credits are deducted from your balance. If this takes your balance below zero because refunded credits had already been spent, playing, tools, unlocks, ad-free and playing with others are blocked until you have bought credits worth twice the negative amount; every credit you buy is credited to you (Terms of Use, section 3). Your account, credit purchases, account deletion and feedback stay available. For this we store the open amount, the credits still missing and which purchases counted towards them with your account. If your account meets the block at sign-in or when starting to play, our operator receives at most one message a day with a short code (pseudonym) instead of your account identifier, your level, these amounts and the time (Art. 6(1)(f) GDPR, enforcing our claim).

Information for Apple on refund requests. If you ask Apple to refund a purchase, Apple may ask us about consumption. Only if you agreed to the line under the purchase button when buying does our server answer Apple with this information: whether the credits were delivered, what share of the purchased credits has already been spent, that the game is playable without a purchase, and our refund recommendation. We do not send names, game states or identifiers other than the transaction number. Without your consent we do not answer Apple. We store on your account whether and when (server time) you agreed and to which text version; you can withdraw your consent at any time under “Account”, and pending answers are then discarded. The legal basis is your consent (Art. 6(1)(a) GDPR).

First-purchase list. For offers to first-time buyers, a bonus on the first purchase of a credit pack is to be granted only once, also when someone creates a new account. For this purpose, after a purchase through Apple or Google Play, our server records that a purchase was made, as irreversible check values derived with a secret key (HMAC): one from the sign-in identifier of your account and, for purchases through Apple, another one from the identifier that Apple assigns to your App Store account for this game (appTransactionId). Google Play provides no such identifier; there only the sign-in identifier is used. With each check value we store only a month: the month of the last purchase or, where we do not know it, the month in which the entry was created. We do not store your name, your email address or any identifier in plain text for this. An entry is deleted 25 months after the end of that month; until then it remains even after you delete your account, because otherwise the bonus could be obtained again by deleting the account and creating a new one. The legal basis is our legitimate interest in protecting our offers against misuse (Art. 6(1)(f) GDPR). We do not pass the entries on to third parties.

You can also earn credits by watching optional rewarded videos (section 6). Among other things, credits pay for the one-time unlock for playing with others, that is, opening your yard to visitors and joining other players' yards. A private world stays free. Only our server checks the price and your balance.

6. Advertising and tracking

After the intro, the app shows banner ads, occasional full-screen ads during natural breaks in play and optional rewarded videos through Unity LevelPlay. No full-screen ads are shown during the intro. A full-screen ad is only possible at these points: after a round ends, after completed research, after a finished build, after a sale, after a completed order, when you close the shop or your account and return to the game, when you return from a menu or from offline play, when you leave a yard, and when you return to the app after it has been in the background for at least one minute. No full-screen ad interrupts active play. The default is: the first full-screen ad after installation no earlier than after three minutes of active play, then at least five minutes of active play between two full-screen ads, and at most four full-screen ads per hour. The game server sets these values within fixed limits (first ad no earlier than after one to thirty minutes, spacing two to sixty minutes, one to twelve full-screen ads per hour); if we change them, we update this text. Rewarded videos only start when you tap them yourself. The ad network is Unity LevelPlay (formerly ironSource) by Unity Technologies; through LevelPlay mediation, ads from other advertising partners may be delivered.

ironSource Ads, Unity Ads and Liftoff Monetize (Vungle) are integrated through Unity LevelPlay. Unity and Liftoff may process data outside the EU, including in the USA, under their respective terms. Their Unity privacy policy and Liftoff privacy policy explain responsibilities, recipients, retention, transfers and data protection rights.

Depending on the installed app version and enabled advertising configuration, Chartboost LLC (part of the LoopMe group) may additionally provide interstitial ads through Unity LevelPlay. This may involve processing IP addresses, device and app information, available advertising identifiers, and ad impression and interaction data. Your advertising and tracking choices in the app and operating system continue to apply. Details about data processing, recipients, transfers and privacy rights are available in the Chartboost/LoopMe privacy notice.

The intro is shown first when the app starts. After it ends or is skipped, and before an advertising SDK starts, you explicitly choose personalized or non-personalized advertising in the app. An earlier iOS tracking permission does not replace this choice. Only after you choose personalized advertising does the app also request iOS App Tracking Transparency (ATT) permission, if required. Personalization is enabled only when you consent in the app and ATT currently permits it. If you choose non-personalized advertising or deny ATT permission, the app sends these restrictions to the advertising SDKs; IDFA is unavailable without ATT permission. Non-personalized advertising does not mean that no data is processed.

You can withdraw your consent for future processing in the app settings and change iOS permission under Settings → Privacy & Security → Tracking. On returning to the app, it checks permission again, updates advertising settings and discards cached ads that have not yet been shown. A full-screen ad already being displayed may finish. Withdrawal does not lock gameplay or existing purchase entitlements.

Unity LevelPlay and its integrated advertising partners process data to deliver, measure and bill ads and prevent fraud, including IP address, device model, operating system, language, device or installation identifiers, and ad views and clicks. Liftoff Monetize (Vungle) also expressly lists coarse location, device identifiers, advertising data, product interactions, technical performance data and ATT status for third-party advertising and advertising analytics. Coarse location can be derived from the IP address; the app does not request GPS location. When tracking is permitted, this also includes IDFA and permitted linkage with data from other apps or companies. Device and installation identifiers are pseudonymous, not anonymous.

Rewarded videos: They are optional and require an online account for credit claims. Before a video starts, the server shows its reward and the remaining allowance; the current policy is one credit and at most ten reserved or completed eligible views within 24 hours. If an ad fails to start, its reservation is released. Credits are granted only after a verified server callback; delayed confirmations may arrive later.

The advertising SDK receives a random installation identifier kept in the device Keychain, not an Apple identifier or sign-in token. An opaque, one-use reservation identifier connects the ad view to the requesting account on our server. Reward records are private. Hashes of processed events may remain without an account link after account deletion to prevent duplicate payouts.

Test variants of ad placements. To compare ad placements, the app may assign an installation to a test variant. For this, the app rolls a random number from 0 to 99 once and stores it on your device; when it fetches the ad settings from our game server, it transmits only this number. The number is not an identifier: many installations share the same number, and the app does not create or send any device, installation, account or advertising ID for this. The variant only changes the internal name of the ad placement that the app passes to LevelPlay, and thereby which full-screen ads are selected and how often they appear within the limits stated above. No additional data is collected for this.

Optional ad measurement (iOS only). Once the app offers it, you can turn on the optional setting “Help improve ads voluntarily” under “Account”. It is off until you switch it on and is independent of your choice about personalized ads. Only when you turn it on does the app create a separate, random measurement identifier. It is stored only on this device in the keychain and is not linked to your account, your display name, your Apple ID or the advertising identifier (IDFA). With this identifier the app sends to our own game server: the app build, times at which you use the app (at most one entry per minute), the game breaks at which an ad could have been shown and whether and why it was or was not shown, displayed ads with format and placement and, where LevelPlay reports it to the app, the revenue per ad, the serving ad network and the country, as well as whether a rewarded video was offered, started, completed and credited. We do not store account data or IP addresses for this. If you are signed in and have objected to usage statistics, the app sends no measurement data.

The purpose is to measure how well advertising pays and to test ad frequencies. During a test your installation may be randomly assigned to a group that sees full-screen ads at the same points less often, at different intervals or from different advertising partners. The limits stated above (a default of at most four full-screen ads per hour, and at most twelve from the server) and the restriction to the existing game breaks apply in every group. We do not share measurement data with advertising partners or other third parties.

If you switch the setting off, collection stops immediately and the app deletes all data linked to your measurement identifier the next time it reaches the server; until then it shows “deletion pending”.

Anonymous ad usage counters. So that we can tell whether the consent dialog, ad breaks and rewarded videos work as intended, the app sends aggregated daily counters to our own game server: how often the advertising consent dialog and the iOS App Tracking Transparency dialog were shown and how often each choice was made, how often an ad break was requested, skipped because no ad was available or because of the frequency limit, shown or ended with an error, how often a rewarded video was offered, started and completed, and how often the app was reopened after a longer time in the background, in each case where applicable with the name of the placement. The only other details are the platform (iOS or Android), the app build and the calendar day (UTC). The counters contain no device, installation, account or advertising identifier (IDFA or Android advertising ID) and no time of day; the server aggregates them per day, platform and build. When they are sent, your IP address is transmitted for technical reasons; the game server processes it only briefly in memory to prevent abuse (section 7) and does not store it. Because the counters cannot be attributed to any person, there is no separate setting for them; we describe them here so that you know what the app sends.

7. Technical connection data and device

Each connection to the game server technically transmits your IP address. The game server uses it only in memory to limit requests per address and thereby fend off abuse and overload. It does not store it in the game database and does not link it to your account. For registering the optional ad measurement, for measurement events and for the anonymous ad usage counters (section 6) and the anonymous game statistics (section 4), the game server additionally counts requests per network, that is per IPv4 address or, for IPv6, per /64 prefix, and per calendar day (UTC), and the uploads of the usage counters also per hour. The counting key is a salted hash of the network: it is formed with a random value that is created anew each time the game server starts, and like that value it is held only in memory. No address is stored. For registering the ad measurement, the game server additionally keeps under this counting key, for the current calendar day, a hash (SHA-256, unsalted) of the registered measurement identifier, so that a repeated registration of the same measurement identifier counts only once; this value too is held only in memory and is not reused for a new calendar day. The connection between app and server is encrypted with HTTPS.

The app keeps its own technical performance log only in its storage area on your device. It is not transmitted to us. This is separate from performance data processed by the advertising SDKs as described in section 6 and from the technical details in crash and error reports (below).

Crash and error reports (Sentry). To detect and fix crashes and errors in the app and the game server, we use the Sentry service (section 10). The app only sends a report when it crashes, stops responding or a technical error occurs. A report contains the stack trace (which parts of the program were active when the error occurred), the error message, the last technical events before the error (for example app start, screen changes or moving to the background), app version and build, operating system version, device model, further technical device details such as language setting, time zone, free storage space and battery level, the state of memory and the game view (WebView), the device's graphics capabilities and whether you were playing solo or online. Join and bonus codes, access tokens, email addresses and similar identifiers are masked before sending.

So that we can tell whether an app version crashes more often than the previous one and fix errors quickly, the app also sends a session report at the start and end of each use with the app version, the status (for example ended normally or crashed) and a randomly generated installation number. This also applies if you play without an account; these reports are not part of the usage statistics in section 4. The installation number is used only to determine the crash rate per app version. It is a separate number, not the installation identifier given to the advertising SDK (section 6). Sentry stores it only in hashed form; it is not linked to your account, your display name, the advertising identifier or your IP address. The installation number, a counter that limits the number of reports per day and, until they are sent, reports and session reports that could not be sent yet, for example after a crash or without an internet connection, are kept on your device; deleting the app removes them.

The game server also reports its errors to Sentry, with error message, stack trace and details of the server environment, but without request contents, IP addresses or account data. Sending from the app technically transmits your IP address; Sentry does not store it. The reports are not used for tracking or advertising; we do not create user profiles from them, and no screen recordings are made. Sentry automatically deletes reports and session reports after 90 days at the latest.

8. Retention

9. Deleting your account

You can delete your account at any time in the app with "Delete account" and then confirm your identity with Apple. Deleting the app from your device does not delete your account. Account deletion does the following:

10. Recipients and hosting

BRUNIQO operates the game server itself on a rented server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner provides the data center and server hardware.

We use Apple services for sign-in, in-app purchases and refund notifications. Apple processes data under its own privacy policy and may also process it outside the EU in line with its infrastructure.

For crash and error reports (section 7) we use Functional Software, Inc. (Sentry), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA, as a processor under Art. 28 GDPR. Sentry stores reports and session reports in the EU (Frankfurt, Germany). Sentry processes administrative data of our Sentry account, such as details of the organization, projects and user accounts, outside the EU in the USA. Because Sentry is a US company, access from the USA, for example in the course of support, cannot be ruled out. For transfers to the USA we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, under which Sentry is certified, and alternatively on the EU standard contractual clauses in Sentry's data processing agreement.

Unity LevelPlay, Unity Ads and Liftoff Monetize (Vungle) are integrated for ads and rewarded videos. Section 6 describes their data processing, including advertising analytics.

11. Legal bases

We process your account, game operation, multiplayer features, credit purchases and account deletion to perform the contract of use (Art. 6(1)(b) GDPR). Limiting requests per IP address and keeping the purchase remnants after account deletion are based on our legitimate interest in secure operation and in handling refunds correctly (Art. 6(1)(f) GDPR).

Personalized ads, access to the advertising identifier and tracking are based on your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time with effect for the future. Showing non-personalized ads to fund the free game is based on our legitimate interest (Art. 6(1)(f) GDPR). Crediting rewarded videos serves the performance of the contract of use (Art. 6(1)(b) GDPR).

Usage statistics for signed-in accounts: legitimate interest (Art. 6(1)(f) GDPR) in operating the game reliably and improving it in a targeted way; only aggregated figures are evaluated.

Crash and error reports as well as session reports (Sentry): legitimate interest (Art. 6(1)(f) GDPR) in a stable, secure app and a reliable game server, that is, in detecting and fixing crashes and errors. The app stores the installation number, the report counter and reports and session reports not yet sent on your device without consent, and reads the technical device details listed in section 7 for this purpose, because this is strictly necessary to provide the app you are using in a stable and working state (Section 25(2) no. 2 TDDDG).

Optional ad measurement, including storing the measurement identifier on your device, is based on your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time with effect for the future by switching the setting off. We keep the hash after withdrawal to enforce your withdrawal (Art. 6(1)(c) and (f) GDPR).

Anonymous ad usage counters: legitimate interest (Art. 6(1)(f) GDPR) in keeping the consent dialog, ad breaks and rewarded videos working and in running the advertising that funds the free game economically. The counters cannot be attributed to any person; the brief processing of the IP address when they are sent serves to prevent abuse.

Anonymous game statistics of the app: legitimate interest (Art. 6(1)(f) GDPR) in running the game stably, improving it in a targeted way and running the advertising that funds the free game economically. Only aggregated figures are evaluated; the daily sums cannot be attributed to any person.

Internal player profile: legitimate interest (Art. 6(1)(f) GDPR) in running the free game economically through purchases and advertising and in developing prices, offers, ad placements and game balance from actual courses of play. The profile is pseudonymised, accessible only to us as the operator, not passed on and not used for personalised ads; you can object at any time (section 12).

12. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests. You can also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW). Please send requests to support@bruniqo.de.

Objection to usage statistics: write to support@bruniqo.de and include your account ID (in the game under Account, entry “ID”). We will then exclude your account from the statistics permanently and delete existing day marks and the stored creation day. From your app's next contact with the game server, it also no longer counts or sends anonymous game statistics for your account. Because the daily sums are not linked to any account, we cannot delete counters that were already sent individually.

Your objection to the usage statistics also applies to the internal player profile (section 4): we immediately delete an existing profile together with its event history and no longer create one for your account; a guest profile is then deleted on sign-in instead of being taken over. Bookings we need for purchases and balances are not affected. If you withdraw your objection, a profile starts only from that point. On request to support@bruniqo.de with your account ID you receive access (Art. 15 GDPR) including your internal player profile with its event history, also after we have stopped collecting. We cannot attribute a guest profile to any person without an account (Art. 11(2) GDPR).

We cannot attribute crash and error reports or session reports to any person or account. We can therefore act on a request for access, erasure or objection concerning individual reports only if you give us details that let us find your reports (Art. 11(2) GDPR).

We cannot attribute ad measurement data to a person without your measurement identifier; switching the setting off deletes it. Other requests we handle under Art. 11(2) GDPR to the extent you provide information that lets us find the data.

13. Changes

We update this policy when data flows or app features change materially. The version published on this page applies.

14. Android app „Nadel im Heuhaufen“ (Google Play)

On Google Play the game is listed as „Nadel im Heuhaufen“ (package name de.bruniqo.nadelimheuhaufen). It is the same game, with the same game server, as The Needle in the Haystack 2 on iPhone. Sections 1 to 13 also apply to the Android app. Where Android works differently, this section applies in addition.

14.1 Sign in with Google

On Android you can create an online account with “Sign in with Google” through the Android Credential Manager. Our server verifies the sign-in token issued by Google against Google's public keys. We store only a non-reversible value derived with a secret key (HMAC) from your Google account identifier, mapped to a random internal account ID. We do not store your Google e-mail address, name or profile picture. We do not store a Google refresh token.

An account created with Google is a separate account. Google and Apple accounts are not merged, and credits and purchased tools are not transferred between them. On Android the session token is stored encrypted in the app's storage on your device, with the key held in the Android Keystore. Otherwise section 3 applies to sessions.

14.2 Sign in with Apple

On Android you can also choose “Sign in with Apple”. The app opens Apple’s sign-in page in the browser. Our server verifies the sign-in with Apple and exchanges the one-time authorization code with Apple. We do not store your Apple account identifier in plain text; we store only a non-reversible HMAC mapped to a random internal account ID. We store the refresh token issued by Apple in encrypted form so that we can revoke the link to your Apple ID if you delete your account. An account created with Apple is not merged with a Google account; credits and purchased tools are not transferred between them.

On Android the session is stored encrypted in the app’s storage on your device, with the key held in the Android Keystore. Otherwise section 3 applies to sessions.

14.3 Credit purchases through Google Play

On Android you buy credit packs through Google Play Billing. Google alone handles the payment; we do not receive any payment or card data. The app passes Google a random purchase identifier linked to your game account. Our server verifies every purchase directly with Google through the Google Play Developer API and credits it exactly once. For each purchase we store the Google order number, the product, the credits granted and any refund status.

Google notifies our server of refunds and voided purchases through Google Play Real-time Developer Notifications (delivered via Google Cloud Pub/Sub). Refunded credits are deducted from your balance; section 5 applies accordingly to a balance that falls below zero. After an account deletion, the order number, the time of the last Google notification and a non-reversible hash of the purchase identifier remain stored, as described for Apple in section 9.

14.4 Ads and advertising ID on Android

On Android, ads and rewarded videos also run through Unity LevelPlay with Unity Ads, Liftoff Monetize (Vungle) and, depending on ad configuration, Chartboost. Section 6 applies accordingly. The app does not ask for your age or date of birth. After the intro you choose between personalized and contextual (non-personalized) ads; only then does an ad SDK start. An age category that earlier app versions stored encrypted on your device after an age prompt is deleted by the app at its next start. You can change this choice in the app settings at any time.

Android has no App Tracking Transparency (ATT) and no IDFA. Instead, the ad SDKs can read Google's advertising ID (Android advertising ID); the app declares the Android AD_ID permission for this. The app passes your choice to Unity LevelPlay as GDPR consent and additionally sets the signal that data should not be sold (CCPA). You can reset or delete the advertising ID in the Android settings. The ad SDK also receives a random installation ID that the app stores encrypted on the device.

14.5 Deleting your account on Android

You delete your account in the app with "Delete account" and confirm deletion by signing in again with the same provider, Google or Apple. The consequences in section 9 apply; for a Google account the value derived from your Google account identifier takes the place of the Apple identifier. We do not store a Google token that would need to be revoked. A stored Apple refresh token is used for revocation when you delete an Apple account. Without the app or without signing in: How to delete your account.

14.6 Google as a recipient

For Sign in with Google and for purchases through Google Play, including refund notifications, we use services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes data under its own privacy policy and may also process it outside the EU, in particular in the USA, in line with its infrastructure. Details are in Google's privacy policy. The legal bases in section 11 apply accordingly.