Privacy policy
Last updated: October 29, 2026
This page explains which personal data Needle Drop collects, why, and what your rights are (General Data Protection Regulation, GDPR). Needle Drop is a free, non-commercial project. Contact: contact@echo-nexus.fr.
1. Data we collect
- Account: your username, your e-mail address and your password (stored only as a secure hash, never in clear text).
- Sign in with Google: if you choose it, Google sends us your e-mail address, your name and a technical identifier of your Google account. We do not receive your Google password and we have no access to your other Google data.
- Game progress: your Vibes, the looks you own and wear, your feats and simple counters (songs played, notes picked up, loves received).
- While you play: your position and animation on the record, your dance and emotes, your votes, the songs you queue and your chat messages. They are shown to the other players. The last 40 chat messages are kept in memory to show to players who join; nothing is written to disk.
- Technical data: your IP address and connection times, in the server logs, for security (protection against attacks and repeated failed sign-ins).
- Stored only in your browser: your sign-in session, your volume and your camera choice.
2. YouTube and Deezer
- Music: songs play in the official YouTube player embedded in the page. YouTube (Google) may collect data and set cookies when it plays, as described in the Google Privacy Policy. Playing music means you also accept the YouTube Terms of Service. You can manage the data Google keeps at security.google.com.
- YouTube API: our server uses the YouTube API Services to check that a video is music and to find the video of a song you pick by name. It only sends the song name or the video link, never your identity. The video found for a song is remembered to avoid searching it again.
- Search by name: our server sends the words you search to the public Deezer catalogue to show song titles and artists. Deezer does not receive your identity.
3. Why we use it
- To create and secure your account and let you sign in (performance of the service).
- To save your progress and run the online game with the other players (performance of the service).
- To send you the e-mails needed for your account: address confirmation and password reset. No newsletter, no advertising.
- To protect the service against cheating and attacks (legitimate interest).
4. Sharing
Your data is never sold or rented. Only your username, your look, your position, your votes, the songs you queue and your chat messages are visible to other players. The servers are hosted in France (OVHcloud). E-mails are sent through our e-mail provider. Google only takes part if you choose to sign in with Google, and through the YouTube player as described above.
5. How long we keep it
- Account and progress: as long as your account exists. Accounts inactive for 3 years may be deleted.
- Server logs: 12 months at most.
- Backups of the game database: 14 days.
6. Your rights
You can access, correct or delete your data, ask for a copy of it, or object to its use: write to contact@echo-nexus.fr from the e-mail address of your account. Deleting your account deletes your progress. You can also file a complaint with the French data protection authority (CNIL, www.cnil.fr).
7. Cookies
Our sign-in page only uses the cookies needed to keep you signed in. No advertising or tracking cookies of our own. The YouTube player may set its own cookies (see section 2).
8. Children
Needle Drop is not intended for children under 13. If you are under the age required in your country, ask a parent before creating an account.