Privacy policy

Last updated: October 2026

Tl;dr: we store your farm, a nickname and, if you save your farm, your email address. We don’t sell anything, we don’t track you across the web, and you can delete everything from your account page.

Who is responsible

SANTiHANS GmbH, CH-4056 Basel, Switzerland, [email protected]. We process personal data in line with the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

What we process, and why

Your farm: game state, scores and play statistics (for example how many potatoes you planted), to run the game and show the leaderboard. Basis: performance of our contract with you.
Nickname and invite relationships: shown publicly on the leaderboard and pyramid pages. Basis: contract; you can change your nickname at any time.
Email address (only if you save your farm): to send you sign-in links. We don’t send newsletters. Basis: contract.
Technical data: IP addresses are used to limit abuse and are stored only as salted hashes; your browser’s user agent is stored with your session. Basis: our legitimate interest in a secure, fair game.
Usage events: things like “reached stage 3”, “bought rain” or “signed in”, tied to your farm, to understand and balance the game. Basis: legitimate interest.
Purchases: what you bought, when and for how much. Payment details are handled by Stripe; we never see your card. Basis: contract and legal obligations (bookkeeping).

Service providers

Vercel (hosting), a managed Postgres provider (database).
Brevo (Sendinblue SAS, Paris, France): sends sign-in emails. It receives your email address and the email itself, and keeps delivery logs for a limited time. We don’t use it for newsletters, and tracking of opens and clicks is turned off.
Stripe (payments), which acts as an independent controller for payment data.
Cloudflare Turnstile (bot protection on sign-in).

Brevo processes data in the European Union. Vercel, Stripe and Cloudflare are based in the United States; transfers there are covered by the Swiss-US and EU-US Data Privacy Frameworks or by standard contractual clauses.

How long we keep data

Guest farms that haven’t been played for 12 months may be deleted.
Accounts are kept until you delete them. Deleting removes your email, farm and scores right away.
Purchase records are kept for 10 years, as required by Swiss bookkeeping law.
Sign-in links expire after 15 minutes and are deleted a day later; rate-limit counters after at most two days.

Your rights

You can ask us for access to your data, have it corrected or deleted, receive a copy, or object to its processing. Most of this you can do yourself on the account page. For anything else, email [email protected]. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or to your local data protection authority.

Cookies

See the cookie policy. In short: only what’s strictly necessary.