The Needle in the Haystack 2 Privacy Policy

Last updated: 2026-09-25

1. Controller

The controller for data processing in the app The Needle in the Haystack 2 is BRUNIQO, Alessandro Brüning, Katharina-Minos-Breckeler-Straße 4A, 41462 Neuss, Germany. Email: support@bruniqo.de. Further details are in the legal notice (Impressum).

This policy covers the iOS app The Needle in the Haystack 2 (German title: Nadel im Heuhaufen 2) and its game server. The website privacy policy applies to visits to this website.

2. Overview

The Needle in the Haystack 2 is a cooperative online game for up to eight players. You need Sign in with Apple and an internet connection to play, because your player profile, yards and credits are stored on our server.

The app contains no advertising, no tracking and no third-party analytics or crash-reporting services. It does not access your location, contacts, camera, microphone or photos.

3. Sign in with Apple

You sign in with "Sign in with Apple". The app does not request your name or email address from Apple. Our server verifies the sign-in directly with Apple and redeems the one-time authorization code with Apple.

We do not store the user identifier supplied by Apple in plain text, only as an irreversible check value derived with a secret key (HMAC). This check value is mapped to a randomly generated internal account identifier. We also store the refresh token issued by Apple in encrypted form so that we can revoke the link to your Apple Account with Apple when you delete your account.

After sign-in the app receives a random session token, which is kept in the keychain on your device. On the server we store only a hash of it. A session is valid for at most 30 days; "Sign out" ends it immediately. If you sign in on another device, the previous session ends after you confirm.

4. Player profile and game progress

For your account we store your display name (by default "Spieler"), the appearance of your character, game values such as level and experience points, your personal credits, permanently acquired tools, and your current and recently visited yards.

For each yard the server stores the game state, for example digging progress, built facilities and machines, the yard's money, research, equipment and the retention deadline. The game state is built from a log of game actions that records which player account performed which action.

While you play in a yard, the other members of that yard see your display name, your character's appearance, its position and activity in the game world, and quick-chat messages you send. This also applies to public crews with players you do not know. Quick-chat messages are preset phrases; free text, voice messages or images cannot be sent. The position is a coordinate in the virtual game world, not the location of your device.

5. Credit purchases through Apple

You buy credit packs with 100, 500 or 1,000 credits through Apple's in-app purchase. Apple handles payment exclusively; we receive no payment or card data.

When you buy, the app passes Apple a random purchase identifier linked to your game account so that the purchase can be credited to your account. Our server verifies the transaction signed by Apple and credits the credits exactly once. For each purchase we store the transaction number, the product, the credits added and any refund status. Apple notifies our server of refunds; refunded credits are deducted from your balance.

6. Technical connection data and device

Each connection to the game server technically transmits your IP address. The game server uses it only in memory to limit requests per address and thereby fend off abuse and overload. It does not store it in the game database and does not link it to your account. The connection between app and server is encrypted with HTTPS.

The app keeps a technical performance log only in its own storage area on your device. It is not transmitted to us.

7. Retention

• Account, player profile, credits and purchase records: until you delete your account.
• Yards: A yard without further activity can expire after 24 hours. Any member can optionally spend personal credits on a minimum retention of seven days; there is no automatic renewal. An expired yard is permanently deleted from the server together with its action log.
• Sessions: at most 30 days.
• Technical request receipts that prevent the same action from being executed twice: about one day. Receipts for yard protection successfully paid with credits are excluded; they are kept, including the yard concerned, until account deletion.
• IP address: only in the game server's memory, see section 6.

8. Deleting your account

You can delete your account at any time in the app with "Delete account" and then confirm your identity with Apple. Deleting the app from your device does not delete your account. Account deletion does the following:

• Your player profile, credits, permanently purchased tools, sessions, the mapping of your Apple identifier and the stored Apple token are deleted. Unused credits are forfeited.
• We revoke the link to your Apple Account with Apple. If this temporarily fails, the server retries the revocation automatically; until then only the encrypted token is kept for this purpose.
• Yards in which you were the only member are deleted together with their action log.
• In shared yards your game contributions remain for the other players. Your account identifier in them is replaced by a random identifier that is not linked to any account, and your display name is reset to "Spieler".
• For completed purchases we keep the transaction number, the time of Apple's latest notification and an irreversible hash of the purchase identifier. This lets us process later refund notifications from Apple correctly and prevents a purchase from being credited again. We can no longer link this data to you.

9. Recipients and hosting

BRUNIQO operates the game server itself on a rented server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner provides the data center and server hardware.

We use Apple services for sign-in, in-app purchases and refund notifications. Apple processes data under its own privacy policy and may also process it outside the EU in line with its infrastructure. We do not pass data to advertising networks, data brokers or analytics providers.

10. Legal bases

We process your account, game operation, multiplayer features, credit purchases and account deletion to perform the contract of use (Art. 6(1)(b) GDPR). Limiting requests per IP address and keeping the purchase remnants after account deletion are based on our legitimate interest in secure operation and in handling refunds correctly (Art. 6(1)(f) GDPR).

11. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability, and the right to object to processing based on legitimate interests. You can also lodge a complaint with a data protection supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW). Please send requests to support@bruniqo.de.

12. Changes

We update this policy when data flows or app features change materially. The version published on this page applies.