Privacy

The short version

Your farm is saved in your own browser and never leaves it, and that includes your name and pronouns if you tell the game either. The game counts things like how many tugboats everybody has printed, and we cannot tell which of them were yours. If you join the email list, we keep your address so we can send you the letters, and nothing else.

There is no account and no login in the game, and the game never asks for an email address. That happens here on this site, if you want it to.

This website is a separate matter from the game. What it loads, and every cookie it sets, is listed under This website further down.

The email list

When you sign up for Letters from the Harbormaster we store your email address, the date you signed up, and which form you used, so we know whether people join from the front page or the roadmap. That is the whole row.

No name, no IP address, nothing bought from anywhere else. The list is not sold or shared. Every letter has an unsubscribe link, and you can also write to us and ask to come off it.

What the game sends

If you leave the anonymous stats setting on, the game sends a small report while you play. It carries a random id your browser invented, a random id for this sitting, how many minutes the report covers, whether the farm is brand new, which build you are running, which copy of the game sent it (our own site or itch.io), whether the window looks like a phone or a tablet or a desktop, counts of what happened since the last report, how many of each product you sold, and which of ten fixed moments you reached.

Nothing else goes in it. No text you typed, no shop name, no name of your own, no pronouns, no printer names, no save file, no screenshots. The report is added to a set of running totals and then it is gone. What survives is the totals, the same totals per day, and one row per farm holding the hashed id, the first and last day it was seen, the device kind, the version, and which copy of the game it was played on.

The feedback box

Settings has a box you can type in. Nothing leaves your browser until you press the button. When you do, we store your message, the time it arrived, the hashed id, the build, the device kind, roughly how long you had played, and which tab you had open.

Whatever you type is what we store, so please leave out anything you would not want written down. We have no way to write back, so there is nothing to gain by including an address. We do read them. That is the point of them.

The install id

The random id your browser made up is never written down as you sent it. The server runs it through SHA-256 with a secret salt that only we hold and stores the result. It cannot be turned back into the id in your browser, and anybody who got hold of the database could not match a row to a person. It is there to count farms rather than page loads.

Your IP address

Cloudflare sees it, as every web server does, because that is how a request gets delivered. We never store it. It is used for the length of one hash, to stop a single machine flooding the endpoint, and that hash is deleted a couple of minutes later.

What we do not do

• No advertising cookies, and nothing that follows you to other websites. The game sets no cookies at all. This site has a few, and every one of them is named under This website below, with what it does and how long it lasts.
• No advertising or marketing trackers, and no data brokers. Nothing is sold or shared.
• No fingerprinting. We do not read your fonts, canvas, screen list or battery, or anything else you did not offer.
• The game asks for no location and sends none beyond a device kind, which tells us nothing.
• No profiles, and no automated decisions about you.

Turning it off

Open Settings in the game and switch off anonymous stats. The game itself then sends nothing at all and the setting sticks. Nothing in the game is locked, slowed or nagged if you turn it off.

If your browser sends Global Privacy Control or Do Not Track, the server drops the report without reading it, whatever the in game setting says. There is no switch for the feedback box because it has one already, which is not typing in it. A message you deliberately sent is kept even with those signals on, because throwing away something you meant to say would be a strange way to respect them.

How long we keep things

The daily counts stay while the game is being made, because comparing one year to the next is the whole point of them. They are counts, not people. The one row per farm is deleted once it has not been seen for 18 months. Messages from the feedback box are kept, because a note about what was confusing in 2026 is still the record of what this game got wrong. Your email stays on the list until you take it off.

Asking us to delete something

We would rather be straight with you than promise something we cannot do. The counters cannot be unpicked. Once your 14 prints are part of a number that says 340,000, there is nothing in that number that is yours and no way to subtract you from it.

Three things we can find, and all of them we will delete if you ask.

• Anything you sent from the feedback box. The quickest route is the box itself. Send a second message saying which one to delete and roughly when, or quote a few words of it.
• The one row for your farm. Open Settings, copy your install id, and send it to us. We hash it the same way the server does, delete the matching row, and tell you when it is done.
• Your email address. Use the unsubscribe link in any letter, or ask us.

You do not have to explain why, and we will not ask you to prove anything, because there is nothing in any of it to prove.

This website

This site is hosted for us by Lovable, and the game is hosted on Cloudflare. Both keep ordinary request logs, which every web server does, to serve pages and keep them up. Everything else that loads in your browser, and every cookie either of them sets, is in the list below.

Our host runs its own visitor analytics on this site. It counts page views: which page you opened, the page you came from, your browser and the language it asks for, a country worked out from your time zone, and how quickly the page loaded. It labels those with a random id kept in a cookie called session-id, which is set to expire after half an hour.

Cloudflare sits in front of this site and sets a cookie called __cf_bm, which tells real visitors from bots. It lasts half an hour, no script on the page can read it, and because it is set for the whole tinyprintfarm.com domain your browser sends it to the game as well.

Our host sets one more cookie, called __dpl. It holds the id of the published version of the site you were handed, and it lasts a day.

This site loads its fonts from Google Fonts, so your browser fetches the font files from Google and Google sees your address when it does. The game serves its own fonts and does not ask Google for anything.

The page the game runs on loads Cloudflare Web Analytics, which Cloudflare adds at its edge to count visits. It reports back to play.tinyprintfarm.com, and the anonymous stats switch inside the game does not turn it off.

The front page asks the game for its public totals so it can show them, which is a plain read of a public number and sends nothing about you. Your browser remembers that answer for a minute so the page does not ask twice.

Children

The game is made for a general audience and is not directed at children. We do not knowingly collect anything from a child, which is easier to promise than usual here, because we do not collect anything from anybody that could tell us how old they are.

Contact

Questions and deletion requests go to privacy@tinyprintfarm.com. A person reads it, so it is the route to use when you want an answer back. The feedback box in the game is the other one, and it needs no address at all.

When this page changes

If we ever start collecting something new, this page gets updated first and the change is written up in the release notes. The list above is the whole list, and it is meant to stay short.