Privacy

This policy covers the game Haru Harbor (“Haru Harbor: Cozy Farm Village”) on iOS and Android and the website haruharbor.com. Last updated: 22 October 2026.

Who is responsible

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

• Alex Viktor Heinrich, c/o Block Services, Stuttgarter Str. 106, 70736 Fellbach, Germany
• Email for privacy questions: [email protected]
• Contact form: haruharbor.com/contact

The essentials

• On the first start the game creates an account without your name and without an email address. Your progress is kept on our servers in Frankfurt am Main, so the market, friends and village communities work and nothing gets lost.
• The game asks for the month and year you were born but stores only your age group. It protects children and teenagers in the chat and in advertising.
• Ads are only videos you start yourself. They are tailored to you only from age 16 and only with your consent.
• Purchases are handled by Apple and Google and checked through RevenueCat and our server.
• For stability and a fair economy we analyse how the game is used under a pseudonym, without advertising IDs and without IP addresses.
• Deleting your account and requesting your data work right in the game. This website sets no cookies and loads nothing from other providers.

Account and progress

On the first start Haru Harbor creates an account. It gets a player ID, which you see in the settings. For your account we store on our servers: your progress (level, experience, Mon and pearls, storage, fields, buildings, animals, decorations and the layout of your village, collection books, achievements, orders and mail), your settings, your profile (player and village name, avatar, age group, country, your consent choices), the state of your purchases (such as first purchase, packs bought, season pass) and a log of the game actions your device sends to the server, with their time.

Our server checks every game action: times, stock and rules. That way nobody can cheat, the market stays fair and your progress is not lost. Your device keeps a copy of your progress so you can harvest, craft and decorate without a connection; the server reconciles it the next time you are online. Every connection technically needs your device’s IP address. [offen: Speicherdauer der Zugriffsprotokolle von Spielserver und Datenbank festlegen]

The data is kept in data centres in Frankfurt am Main: the database at Supabase, our game server at Google Cloud. The legal basis is Art. 6(1)(b) GDPR (providing the game under the terms of use); checking game actions against fraud also rests on Art. 6(1)(f) GDPR, our interest being a fair and safe game. The copy on your device is strictly necessary for the game (Section 25(2) no. 2 of the German TDDDG).

Linking your account

If you like, link your account with Sign in with Apple, Google, Game Center or Google Play Games, so your village comes along to a new device. We then receive an identifier of your account there and, depending on the provider, your name or email address; with Apple you can choose a relay address. [offen: genau festlegen, welche Angaben je Anbieter gespeichert werden] We use them only to sign you in. The sign-in itself is processed by the provider under its own responsibility. The legal basis is Art. 6(1)(b) GDPR.

Age question

At the very start the game asks for the month and year you were born. Only the age group is stored: under 13, 13 to 15, or 16 and over, never the date. The age group decides whether you can chat freely and write direct messages and which kind of ads you see. So children cannot get around these protections, it can only be changed through our support. If you bring back a village, the younger of the two age groups applies. The legal basis is Art. 6(1)(b) and (f) GDPR; our interest is the protection of children and teenagers.

Playing with others

Haru Harbor is played with others. Other players see your player and village name, your avatar and level, your offers at the morning market and in the village paper and, when they visit, your village as it was last saved. In a village community the members also see your role, your requests and donations and weekly titles. Others do not see your player ID.

You add friends with a friend code, a QR code, Game Center or Google Play Games; a friendship needs both sides to agree. Blocking ends a friendship and hides the other player in the village paper, in search and in chat. To protect the market against real-money trading and bots, we check unusual purchases and gifts. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for protecting the market.

Chat, direct messages and moderation

From age 13 you can write freely in your village community’s chat and to friends. We store the message, sender, time and channel to deliver it. A word filter checks every message before it is sent. Chat can be switched off per country where the law there requires it. Under 13 there are only ready-made messages and stickers; these players see only a separate channel of their community without free text.

If you report a message or a player, we store the report with the message and its context. If a message hits a strict word list or three different players report it, it is hidden for the time being; anyone reported by five different people within 24 hours is muted until review. A person makes the final decision, and every measure is stored with its reason. [offen: ob gemeldete Nachrichten zusätzlich von einem KI-Modell vorgeprüft werden; Anbieter und Datenfluss hier nennen]

The Translate button sends a message to a translation service only when you tap it. [offen: Übersetzungsdienst festlegen und hier nennen]

The legal basis is Art. 6(1)(b) GDPR for the chat as part of the game and Art. 6(1)(f) GDPR for filters, reports and moderation; our interest is a safe community, especially for children and teenagers. [offen: Speicherdauer von Chatnachrichten und Meldungen festlegen]

Reporting a problem and support

Under Settings → Help → Report a problem you send us a report with a category, your text and, if you like, a screenshot. It includes, listed visibly in the window: your player ID, app and content version, device and system, language, the log of your last game actions with error codes and, for purchases, the store’s receipts. We use this to solve your problem and delete the report once it is settled, after twelve months at the latest. The legal basis is Art. 6(1)(b) GDPR.

Analytics and stability

So the game runs smoothly, the economy stays fair and we can help you in support, we analyse how Haru Harbor is used. Events carry a pseudonym of your account: an encrypted derivation of the player ID whose key exists only on our server. Never recorded are names, email addresses, IP addresses, advertising IDs, serial numbers, device models, precise locations and the content of messages. The country comes from your profile or your device language, never from the IP address. The data is kept in the EU, at Supabase in Frankfurt.

• Operations, for all age groups: progress, income and spending of Mon, pearls and goods, purchases, account events, errors, loading times and frame rate. Our server creates almost all of these events. The legal basis is Art. 6(1)(f) GDPR; our interest is a stable, fair game with good support.
• Usage, from age 13: which windows and hints you open, which offers you see and what you search for. You can switch this off in the settings as “Usage statistics”. The legal basis is Art. 6(1)(f) GDPR; our interest is making the game easier to understand. [offen: prüfen, ob dafür eine Einwilligung nach § 25 Abs. 1 TDDDG nötig ist]
• Ad campaigns, from age 16 and only with your consent: whether your install came from an ad campaign. On iPhone also only with your permission to track. The legal basis is Art. 6(1)(a) GDPR and Section 25(1) of the German TDDDG. [offen: ob und mit welchem Dienst Installationen zugeordnet werden]

Under 13 we record only operational events. If the game crashes, a crash report with technical details (where the error occurred, app version, system) and the pseudonym goes to a crash reporting service; it is kept for 90 days at most. [offen: Dienst für Absturzberichte festlegen und hier mit Sitz nennen] The legal basis is Art. 6(1)(f) GDPR.

In-game purchases

You buy pearls, the season pass, decoration sets, packs and “Ad-free” through your store: from Apple in the App Store or from Google in Google Play. You enter payment details such as your card number with the store; we do not receive them.

So that a purchase can be checked, credited and restored, we use the service RevenueCat. The game gives RevenueCat an identifier of your account, not your name and not your email address. RevenueCat processes this identifier, your purchase history (products bought, time, price and currency, country of the store, the store’s receipt and transaction number) and technical details such as the app version, operating system and IP address. Our server receives a message about the purchase from RevenueCat, checks the receipt and credits the purchase to your account. If the store reports a refund, we take back the pearls of that purchase.

Apple and Google are responsible for purchase and payment themselves; their privacy policies apply: www.apple.com/legal/privacy and policies.google.com/privacy. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for statutory retention duties.

Advertising

Haru Harbor shows ads only as videos you start yourself, for a fixed reward, from level 10 and at most six a day. There are no banners and no ad breaks. If you want no videos at all, you can buy “Ad-free” once; after that you get the rewards without a video for good. The ad software loads only when you tap a video button for the first time.

The videos are served by Google AdMob, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google processes, among other things, your IP address and the approximate location derived from it, information about your device and the game, the videos you watched, diagnostic data of the ad service and, if you allow it, your device’s advertising ID. Google decides on the purposes and means of this processing itself and is responsible for it. More: business.safety.google/privacy

From age 16, before the first video, the game asks in the European Economic Area, the United Kingdom and Switzerland with Google’s consent dialog (User Messaging Platform) whether ads may be tailored to you; on iPhone, Apple then asks whether the game may track you across other companies’ apps and websites (App Tracking Transparency). Only with your consent are ads tailored to you, and information is stored on and read from your device for that purpose. The legal basis is Art. 6(1)(a) GDPR and Section 25(1) of the German TDDDG. If you decline, you see general videos; the legal basis for those is Art. 6(1)(f) GDPR, our interest being to offer the game free of charge.

For all players, only ads that Google rates as suitable for most audiences (rating “PG”) are requested. Ads about sexual content, dating, gambling, alcohol and politics are blocked. Under 16 there is neither a consent nor a tracking question and only ads that are not tailored to you; in the European Economic Area, the United Kingdom and Switzerland every request is marked “under the age of consent” for this. Under 13 every request carries the child-directed treatment tag: only non-personalised, child-appropriate ads under the US law COPPA and Google Play’s Families Policy. These tags apply to the requests of these players, not to the whole app.

You can change or withdraw your decision at any time in the game under Settings → Privacy, the permission to track in your iPhone’s Settings under Privacy & Security → Tracking, and the advertising ID on Android in the Android settings under “Ads”. Withdrawal applies to the future.

Notifications

Reminders like “Your rice is ripe” are created by the game on your device; they do not pass through our servers. The game asks for permission only after you have finished your first field, and you turn them off in the settings of the game or your device. [offen: Kommen später Mitteilungen vom Server, hier Dienst und Gerätekennung ergänzen]

Children and teenagers

Haru Harbor is made for all ages and gives younger players extra protection. Under 13 there is no free chat and no free direct messages, no ads tailored to you, only ad requests tagged as child-directed and only operational analytics. From 13 to 15 the chat is open with filter, reporting and blocking, ads are never tailored to you, and there is no tracking question.

If you are under 16, talk to your parents or guardians about the game. Parents can write to us at [email protected] at any time, for example if an age group is wrong or an account should be deleted.

Website: visits and hosting

The website runs on our own server at Contabo GmbH in Germany. In front of it stands the network of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA: it receives your request, usually in a data centre near you, wards off attacks and passes it on to our server. The technically necessary details are processed in doing so: your IP address, date and time, the address requested, your browser’s identification and the page you came from. [offen: Absatz zu Cloudflare streichen, falls die Domain nicht über Cloudflare läuft]

Our web server keeps a log of this to detect attacks and find errors, and deletes it after 14 days at the latest. The legal basis is Art. 6(1)(f) GDPR; our interest is secure and reliable operation. Cloudflare and Contabo work on our behalf.

Website: counting visits

We count on the server how often a page is opened per day, how often a partner’s link is opened and how often a store button is pressed. Only a daily number per page, partner and store is stored: no IP address, no browser identification, no time of day and nothing that connects two requests. The browser identification is only read so that search engines and other automated requests are not counted. No script runs in your browser for this. Nothing can be traced back to you.

Once the game is in the stores, the store buttons lead through this website to the App Store or Google Play. We pass the store the partner’s name or the word “website” as a campaign, and nothing else about you.

Website: storage in your browser

This website sets no cookies and loads nothing from other providers, not even fonts. Your browser keeps only what you choose yourself: light or dark and whether motion is paused. This is necessary to keep the appearance you chose (Section 25(2) no. 2 of the German TDDDG). The values stay in your browser and are not sent to us.

Contact form and email

If you write to us through the contact form or by email, we process your email address, your message and, if you give them, your name and topic, in order to answer you. Messages from the form are sent by email to our mailbox; if that fails, we store them on our server until we have read them. Mailbox and server are at Contabo GmbH in Germany. Against spam we use a hidden field, a timing check and a daily limit, not a third-party service.

The legal basis is Art. 6(1)(b) GDPR where your message concerns your use of Haru Harbor, otherwise Art. 6(1)(f) GDPR; our interest is to answer enquiries. We delete enquiries once they are settled, after twelve months at the latest, unless a statutory retention duty applies.

Pre-registration (email at launch)

On haruharbor.com/notify (and the same page in the other languages) you can sign up for one email when Haru Harbor comes out. For this we store your email address, the language of the page, the stores you chose (App Store, Google Play) and the times you signed up and confirmed. First we send you an email with a link to confirm (double opt-in); only then are you on the list. If you do not confirm, we delete the address after 7 days.

As soon as the game comes out in a store you chose, you get exactly one email for it. Once you have had all the emails you asked for, we delete your address. You can unsubscribe at any time through the link in our emails, on the pre-registration page or by writing to us; we then delete the address at once. There is no newsletter, and for any other email we would ask for your consent again.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 7(2) no. 2 of the German Act against Unfair Competition), which you can withdraw at any time with effect for the future. We store the times of sign-up and confirmation to be able to prove your consent (Art. 7(1) GDPR); we do not store your IP address for this. The list and the emails are kept on our server and in our mailbox at Contabo GmbH in Germany; we use no newsletter service. We count the number of sign-ups as a daily total that relates to no person and, if you come through a partner’s link, for that partner.

If you are under 16, you need the consent of your parents or guardians to sign up.

Discord and social networks

We link to our Discord server and our profiles on TikTok, Instagram and YouTube. They are plain links: this website loads nothing from these services. If you follow a link or join our server, the privacy rules of that service apply. Discord, Inc. is based in the USA.

Service providers and recipients

The following work on our behalf and on our instructions (Art. 28 GDPR):

• Supabase, Inc., USA: database, sign-in, chat delivery and file storage, in the data centre in Frankfurt am Main.
• Google Cloud EMEA Limited, Ireland: our game server (Cloud Run) in Frankfurt am Main.
• RevenueCat, Inc., USA: checking, crediting and restoring purchases.
• Contabo GmbH, Munich, Germany: the server of this website with its counter and contact form, and our mailbox.
• Cloudflare, Inc., USA: protecting and forwarding requests to this website.
• [offen: Dienst für Absturzberichte, Übersetzungsdienst und gegebenenfalls KI-Prüfung gemeldeter Nachrichten ergänzen]

The following process data as controllers in their own right:

• Apple Distribution International Ltd., Ireland: App Store, purchases, Sign in with Apple, Game Center and the tracking question on iPhone.
• Google Ireland Limited and Google Commerce Limited, Ireland: Google Play, purchases, sign-in with Google and Google Play Games, the consent dialog and the ads (AdMob).

We do not sell data and pass it on to no one else, unless the law obliges us to.

Countries outside the European Union

Progress and analytics are kept in Frankfurt am Main. Supabase and RevenueCat are companies in the USA; where they process or access data from the USA, this is based on the European Commission’s standard contractual clauses. Google and Cloudflare are certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). [offen: Verträge zur Auftragsverarbeitung und Übermittlungsgrundlagen je Dienst prüfen]

How long we keep data

• Account, progress and profile: until you delete your account. After the deletion period of 14 days the server deletes the account, progress, log and all analytics under your pseudonym.
• Log of game actions: 90 days.
• Analytics: single events 13 months, usage and performance events 90 days, daily totals per player 25 months; totals that relate to no person without a limit.
• Crash reports: 90 days at most.
• Purchase data: for as long as it is needed to provide and restore purchases and statutory retention periods run.
• Chat messages and reports: [offen: Frist festlegen].
• Database backups: [offen: Frist festlegen].
• Problem reports and enquiries: until they are settled, twelve months at most.
• Pre-registration: unconfirmed addresses 7 days; confirmed ones until you have had the emails you asked for, or until you unsubscribe.
• Web server log: 14 days at most.
• Website counter: daily numbers that relate to no person, without a limit.

Deleting your account and requesting your data

Under Settings → Account → Delete account you start the deletion. It begins with a period of 14 days in which you can cancel. Under Settings → Account → Data request the game prepares a file with your profile, your progress, your purchases, your pearl transactions and the log of your game actions, also without a linked account. More: haruharbor.com/delete-data

Your rights

You have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). You can withdraw a consent at any time with effect for the future (Art. 7(3)). Write to us at [email protected], ideally with your player ID.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority where you live.

Your right to object

Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). We then stop processing the data, unless there are compelling legitimate grounds for it or the processing serves legal claims.

Voluntary details and automated decisions

You are not obliged to give us data. Without an account and progress on the server, however, Haru Harbor cannot be played. Messages are hidden and players muted automatically only for the time being, until a person decides; there are no decisions taken solely by automated means that affect you legally (Art. 22 GDPR).

Changes

We update this policy when Haru Harbor or the law changes, for example when new features arrive. The version on this page applies.