Privacy Policy
Last updated Nov 11, 2026. Applies to Night Nabbers on its own website, in its app-store versions and on every game portal or platform it is played on.
Night Nabbers is a free game made to need as little personal data as possible. The game never asks for an email address, a real name, a phone number, a birthday, photos or your location, and players cannot type messages to each other. The only exception is the optional newsletter and creator-application forms on our website (section 3), where you type an email address yourself. This page explains exactly what the game does keep, why, for how long, and how to download or delete it.
1. The short version
- You can play without an account. The game makes up a random player id for you.
- Chat is fixed quick phrases and emotes only. Display names and the titles of things you build are filtered.
- We do not sell personal data and run no third-party trackers. The only ads on our own website are Google's, always in child-directed mode (no personalised ads).
- Settings > Privacy in the game lets you switch off anonymous statistics, download your data, or delete it.
- Inactive data is deleted automatically: guest players after 13 months without play, signed-in players after 24 months.
2. Stored on your device
The game saves in your browser's local storage (or the app's storage): your progress, den, buddies, cosmetics and settings; tutorial and "already seen" markers; the list of players you blocked; a sign-in token for your random player id; a random device id the server uses (only as a salted hash) to stop invite and reward abuse; a random number that places you in game-design tests (for example a shorter tutorial); and, when anonymous statistics are on, the day you first played, how you first found the game and the day you last played. A small offline cache holds the game's own files. The game itself sets no cookies (Google's ads on our own website may use their own, see section 5). On CrazyGames, Yandex Games, Facebook Instant Games, Telegram and YouTube the portal also keeps a cloud copy of your save so it follows your portal account. Clearing site data, or Settings > Privacy > Delete my data, removes all of it.
3. Stored on our game server
When you play online (streets, friends, crews, leaderboards, trading), our server on Cloudflare stores the following. It is keyed by your player id, never by your real identity.
| What | Why | How long |
|---|---|---|
| Player id: a random guest id, or the id of the account you signed in with on CrazyGames, Telegram or Discord. Your raccoon's display name (filtered for bad words). | To recognise you when you come back and show your name to other players | Until you delete it; automatically 13 months after your last save as a guest, 24 months as a signed-in player |
| Game progress: coins, den and buddies, outfit, season and quest progress, ranked rating, scores on daily and weekly boards | Running the game, leaderboards, fairness and anti-cheat | As above; daily and weekly boards reset on their own |
| Social features you use: friends and friend codes, crew membership and crew quick-chat phrases, gifts, trades, market listings, raids and revenge records, taunts | So these features work | As above; trade history 180 days, raid and taunt records at most 90 days, the last 30 crew phrases per crew |
| Things you build and share: courses and arenas (titles are filtered for bad words, links and contact details), your best runs and ghost replays, Night Reel clips, likes | Showing them to other players | As above; Night Reel clips 28 days |
| Creator program (only if you apply): the name and channel link you send, your creator code, who supports it | Reviewing applications and counting supporters | Until you delete it or leave the program |
| Newsletter (only if you sign up on our website): your email address, the language of the page, which page the form was on, the time you signed up, whether you ticked the consent box, and a salted one-way hash of your network address | Sending you occasional Night Nabbers news by email, only if you ticked the box. The sign-up form itself sends no email | Until you unsubscribe or ask us to erase it (the network hash is blanked after 180 days) |
| Creator application from our website (only if you send one): your name, channel link, platform, audience size, email address, optional message, language, the time, and a salted one-way hash of your network address | Reviewing your application and replying to you by email | Deleted after 12 months, or sooner if you ask us to erase it (the network hash is blanked after 180 days) |
| Reports you send, reports about you, mutes and building bans | Keeping the game safe | Reports 30 days; mutes until they end; bans while they stand (these stay even if you delete your data) |
| Salted one-way hashes of your network (IP) address and of the random device id, attached to invite links, referrals and creator supports. The address itself is never stored. | Stopping one person from faking many players to farm rewards | Blanked after 180 days |
| Night alerts (only if you turn them on): the push address and keys your browser gives us, your time zone, language and a few game hints (an egg waiting, your daily streak) | Sending at most one game notification a day, never at night | Until you turn alerts off, delete your data, or 180 days after your last visit |
| A Telegram "share to story" picture you chose to share | Telegram downloads it from us | 1 hour |
| A den you move to another device with a Den Key | The transfer | Until it is claimed, then 30 days |
Network data. Like any website, our servers see your IP address. The game server keeps it only in memory, for rate limits and fair seating while you are connected; it is not written to our database. Our hosting providers keep short technical logs for about a week at most (the game server samples 1 in 100 requests). Error logs may contain a player id, never a name or address.
Anonymous statistics. If they are on, the game sends a few counters per session: which portal or link it was opened from (for example "crazygames" or a campaign tag), the referring website's domain, your country (worked out from the connection and not stored with anything else), phone, tablet or desktop, the day you first played and how many days ago that was, seconds played, which tutorial steps a new player reached, how many ads were shown and which game-design test group you are in, plus short reports of game errors (the error message and the game file and line it came from, with web addresses, e-mail addresses and long numbers removed). They carry no player id, no device id, no IP address and nothing from your save, and they are kept for at most 3 months. You can switch them off in Settings > Privacy. On our own website and apps, and on Steam, Discord, Telegram and Facebook Instant Games, visitors in the EU, EEA, UK and Switzerland are asked first, and nothing is counted or stored until they say yes.
4. Sign-in through a platform
If you play signed in, the platform sends us a signed token that we check. We keep only what is listed above. From CrazyGames we receive your user id and username; from Telegram your user id, first name, username and language; from Discord your user id and username. On Yandex Games and Facebook Instant Games your platform name may be used as your display name. We do not receive passwords, emails, contacts or profile pictures.
5. Game portals and ads
On portals (CrazyGames, Poki, Yandex Games, GameDistribution, GameMonetize, GamePix, Playgama, YouTube Playables, Facebook Instant Games) the portal loads its own software, shows the ads, asks for any cookie or ad consent and may personalise ads under its own privacy policy. Night Nabbers only asks the portal "show an ad now" and passes it no personal data. The portals that host children's games apply their own child-safe ad settings.
On our own website the game can show short ads served by Google (Ad Placement API / AdSense for games), for example between nights or when you choose to watch one for a reward. Every ad request is marked child-directed and as coming from a user under the age of consent: Google then serves no personalised ads and does no interest-based targeting or remarketing. Google's own policy applies: How Google uses information from sites that use its services. The app-store versions, Discord, Telegram and Steam show no ads.
6. Who processes the data
- Cloudflare runs the game server, its database and the anonymous statistics on our behalf.
- Vercel hosts the website.
- Google serves the ads on our own website (child-directed, non-personalised), as an independent controller under its own policy.
- Push services run by your browser's maker (Google, Apple, Mozilla, Microsoft) deliver Night alerts if you turn them on.
- The portal or platform you play on, under its own policy, for what it does itself.
These providers may process data outside your country, under their standard data-protection terms. We never sell or rent data and never share it with advertisers or data brokers.
7. Why we may use it (EU and UK)
Running the game you asked to play (contract); keeping it fair and safe, and preventing abuse (legitimate interests); anonymous statistics outside the EU, EEA, UK and Switzerland (legitimate interests, and you can switch them off); anonymous statistics on our own channels in those countries, and Night alerts (consent, which you can withdraw in Settings at any time).
8. Children
Night Nabbers is suitable for a general audience including children. We do not ask anyone for their age, name, email, photo or location, players cannot type messages to each other, display names and titles are filtered, and we do not use data for behavioural advertising. What we keep is only what the game needs to run (a random id, the raccoon's name and the progress). If you are a parent or guardian and want your child's data, or want it deleted, use Settings > Privacy in the game on your child's device, or email PRIVACY_CONTACT_EMAIL with the raccoon's name and where your child plays. Settings > Grown-ups has play-time, bedtime, friends and outside-link controls.
9. Your rights and choices
- Download your data: Settings > Privacy > Download my data gives you a file with everything on the device and on our server.
- Delete your data: Settings > Privacy > Delete my data erases it from our server and the device at once. Portal accounts themselves are managed by the portal.
- Switch off statistics or alerts: Settings > Privacy and Settings > Night alerts.
- Newsletter and website creator application: these are stored under your email address, not a player id. To unsubscribe and erase them, email PRIVACY_CONTACT_EMAIL from that address and we erase them. Deleting your data in the game does not touch them, because the game does not know your email.
- You can also ask us by email to access, correct, export, delete or restrict your data, or object to its use (GDPR, UK GDPR, CCPA/CPRA, COPPA and similar laws). Email PRIVACY_CONTACT_EMAIL with your raccoon's name or friend code and where you play. We answer within 30 days. You can complain to your data protection authority.
10. Security
All traffic is encrypted (HTTPS and secure WebSockets). Sign-in tokens are signed and expire. Access to the server is limited to the team that runs the game.
11. Changes and contact
If this policy changes we update this page and the date at the top. Privacy questions and requests: PRIVACY_CONTACT_EMAIL.