Privacy Notice

• Account data (email address, password hash, name if provided, Google account identifier when you sign in with Google) — to create and secure your host account and let you sign in. Legal basis: performance of a contract.
• Gameplay data (nickname, room codes, guesses, timelines, scores, game settings) — to run the game and show results to other players in your room. Legal basis: performance of a contract.
• Entitlement and order references (which pass you hold, expiry time, order identifiers received from Paddle) — to give you the access you paid for. Legal basis: contract and legal obligation. We never see or store your card details.
• Spotify connection data (a temporary access token held in your browser and playback state) — to play full tracks on the host device. Legal basis: contract. The token is stored on your device, not on our servers.
• Technical and usage data (IP address, device and browser information, log and error data) — for security, fraud prevention, debugging and improving the game. Legal basis: legitimate interests.
• Support messages you send us — to answer you. Legal basis: legitimate interests.

• Service providers / subprocessors — hosting, database, authentication and error-logging providers that operate the platform on our behalf.
• Paddle, our Merchant of Record, for the sale of access, payments, invoicing, tax compliance and refund handling.
• Spotify, when you choose to connect your Spotify account for playback.
• AI providers that generate artist trivia questions — track metadata is sent, not your personal data.
• Professional advisers (legal, accounting) and authorities where required by law.

We do not sell your personal data or use it for third-party advertising.

Some providers process data outside the EU/EEA. Where that happens we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

Account and entitlement data is kept while your account exists and for as long as needed for legal, tax and accounting purposes (normally up to seven years for transaction records). Room and gameplay data is kept for a short period after a game ends and is then deleted or anonymised. Logs are kept for a limited period for security and troubleshooting.

Under the GDPR you have the right to access your data, correct it, have it erased, restrict or object to processing, receive it in a portable format, and withdraw consent where processing is based on consent. Contact us and we will respond within one month. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.

We use appropriate technical and organisational measures to protect your data, including encryption in transit, hashed passwords, row-level access controls in the database and restricted administrative access. No system is completely secure, but we work to keep risk low.

We use only essential cookies and browser storage: your login session, your player identity within a room, and your temporary Spotify token. We do not use advertising or third-party analytics cookies. You can clear this data at any time in your browser settings, though signing in and playback will then stop working until you sign in again.

Needle Drop is intended for a general audience, but host accounts are not directed at children under 13. If you believe a child has created an account, contact us and we will delete it.

Data controller: Frej Engström, Sweden. For privacy requests, contact us through the app; for order- and payment-related requests you can also contact Paddle at paddle.net.