Hay Day

Is Hay Day safe for kids?

For most children, yes, with purchases locked. Hay Day is a farming game: grow crops, feed animals, fill orders and sell goods at a roadside shop. Contact with other players happens mainly in neighbourhoods, where chat is text only and filtered. The catch is money and data. Apple's listing flags loot boxes in a game rated 9+, diamond packs run up to $99.99, and Supercell's privacy policy allows ad tracking across devices.

We score it 58/100, one point below Clash of Clans (59), which shares its privacy policy and account system, and well below Toca Boca World (73). It has no fines on record. Privacy is the weakest factor.

Neighbourhoods and chat

A neighbourhood is Hay Day's version of a clan: a team that chats, helps with requests and competes in derbies. Neighbourhoods can be open to anyone, invite-only or closed, so a child who joins an open one will chat with strangers of any age.

Supercell's parent guide, written with the UK group Internet Matters, describes the safeguards that apply in all its games. An automatic word filter checks every chat message, player name and team description. It is stricter for young players and in family-friendly settings, where it also tries to block personal details and links that send children elsewhere online. Young players can join only family-friendly teams. Messages can be reported from the chat, and Supercell says moderators review reports within 72 hours and use detection models to scan chat. Penalties run from warnings and mutes to permanent bans.

All of this depends on the age the player gives. A child who enters an adult birth date gets the adult filter and the adult offers.

Diamonds, the Farm Pass and loot boxes

Hay Day is free, and diamonds buy speed: finishing production, expanding the farm, unlocking extras. The US App Store's top purchases range from a Pile of Diamonds at $1.99 to a Trunk of Diamonds at $99.99, with coin packs from $0.99. The Farm Pass and special offers come on top.

Apple's listing also says the game contains loot boxes, paid items with random contents. The game's own App Store description says "some game items can also be purchased for real money (including random items)", but neither the listing nor supercell.com publishes the odds. Clash of Clans, from the same company, carries no such flag. Random paid rewards are the part of game spending that consumer groups and regulators watch most closely, and children are the main concern.

In September 2026 the EU's consumer-protection network opened coordinated actions against nine game companies, Supercell among them, over how virtual currencies are sold. The games flagged for assessment include Clash of Clans but not Hay Day. A case lowers a page's regulatory score in full only when it names the app, so Clash of Clans, now under an open inquiry, starts from 85 and loses three points, while Hay Day, whose diamonds are sold by the same company in a similar way, starts from 88 and loses two as context.

What Supercell collects

Apple's label marks advertising data as used to track you across other companies' apps and websites. Linked to your identity for third-party advertising are coarse location, user and device IDs, product interaction and advertising data; email address and purchase history are linked for Supercell's own marketing, and gameplay content and support messages for other purposes. On Google Play, Supercell says device IDs and app interactions are shared with other companies for analytics and advertising.

The privacy policy, effective 11 March 2026, is broader than the label, so we score on the policy. Supercell relies on its "legitimate interest" to show personalised ads in its games and elsewhere, and asks for consent only where the law requires it, as in the EU. It and its partners link browsers and devices into a "device graph" to measure ads and limit repeats. The protections are for children: the policy says Supercell's games are not directed at under-16s, and the parent guide says young players get no personalised ads or offers and their data is not shared for ad targeting.

Account security

Supercell ID uses one-time codes sent by email instead of passwords, so a leaked password from another site cannot open the farm, but the account is only as safe as the email inbox. There is no authenticator app option. Supercell's security.txt names a vulnerability contact, and we found no public bug bounty. In January 2017 Supercell disclosed that attackers had used a vBulletin flaw to reach its forum in 2016; game accounts were not affected.

The common threat is social. Sites that promise free diamonds or sell grown farms often ask for the login code, which hands over the account. Diamonds bought anywhere but the game and the Supercell Store risk a ban.

How to set it up for a child

1. Create the Supercell ID with an email address a parent controls, and give the real birth date.
2. Turn on Ask to Buy or block in-app purchases on iPhone, or require approval in Google Family Link, and leave no card saved in the Supercell Store.
3. Join a closed neighbourhood run by family or friends, or none at all; the farm works without one.
4. Tell your child never to share a login code and that free-diamond sites steal accounts.
5. If the game takes over, ask Supercell support for a self-exclusion; the account can be restored later.

How we scored it

Regulatory record (86) is the strongest factor: no fines or orders name Hay Day, with two points off for the EU action against Supercell. Privacy (48) is the weakest, because Supercell's policy allows personalised ads and cross-device tracking for players over the age limit. Scams and harmful content (58) sits a little below Clash of Clans because Apple flags loot boxes in Hay Day, though chat is limited to filtered text in neighbourhoods.